CVE-2012-3837

CVE-2012-3837 describes multiple persistent Cross-Site Scripting (XSS) vulnerabilities in Baby Gekko CMS versions 1.2.0 and earlier. Specifically, the username, email_address, password, password_verify, firstname, lastname, and verification_code parameters in the user registration function are susceptible to arbitrary web script or HTML injection. With a CVSS score of 4.3 (Medium), this vulnerability has a network attack vector and medium attack complexity, requiring no authentication. Successful exploitation could lead to information disclosure (C:N/I:P/A:N) due to the injection of malicious scripts. While not listed on the KEV catalog or Hot List, an exploit (EDB-18827) is publicly available on ExploitDB. There is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.