PatchTheCVECVE-2012-3805: Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php
CVE-2012-3805 is a medium-severity flaw (CVSS 4.3) affecting kajona. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_email, or (3) absender_nachricht parameter to the content page; (4) comment_name, (5) comment_subject, or (6) comment_message parameter to the postacomment module; (7) module parameter to index.php; (8) action para
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| EPSS exploit chance | 1.6% (top 24%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2012-07-12 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2012-3805?
kajona: upgrade to newer than 3.4.1. Exact commands for each OS are on this page.
Is CVE-2012-3805 being exploited?
CVE-2012-3805 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2012-3805 affect?
CVE-2012-3805 affects kajona. Severity is medium (CVSS 4.3). Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_emai
How urgent is CVE-2012-3805?
Priority 39/100. Public exploit reference
Software pages
Related CVEs
- CVE-2015-0917 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inje
- CVE-2014-4743 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in te
- CVE-2014-4742 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajo