CVE-2012-4236

Published: Aug 20, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the refresh_page function in application/modules/_main/views/_top.php in Total Shop UK eCommerce Open Source before 2.1.2_p1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Affected (30)

Products: Totalshopuk: Ecommerce

Totalshopuk

1 product

Ecommerce

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Totalshopuk Ecommerce	Up to 2.1.2
Totalshopuk Ecommerce	Version 1.0
Totalshopuk Ecommerce	Version 1.1
Totalshopuk Ecommerce	Version 1.2
Totalshopuk Ecommerce	Version 1.3.1
Totalshopuk Ecommerce	Version 1.3.2
Totalshopuk Ecommerce	Version 1.3.3
Totalshopuk Ecommerce	Version 1.3
Totalshopuk Ecommerce	Version 1.4.0
Totalshopuk Ecommerce	Version 1.4.1
Totalshopuk Ecommerce	Version 1.5.0.1
Totalshopuk Ecommerce	Version 1.5.0
Totalshopuk Ecommerce	Version 1.5.1
Totalshopuk Ecommerce	Version 1.5.2
Totalshopuk Ecommerce	Version 1.5.3
Totalshopuk Ecommerce	Version 1.5.4
Totalshopuk Ecommerce	Version 1.6.0
Totalshopuk Ecommerce	Version 1.6.1
Totalshopuk Ecommerce	Version 1.6.2
Totalshopuk Ecommerce	Version 1.6.3
Totalshopuk Ecommerce	Version 1.7.0
Totalshopuk Ecommerce	Version 1.7.1
Totalshopuk Ecommerce	Version 1.7.2
Totalshopuk Ecommerce	Version 1.7
Totalshopuk Ecommerce	Version 2.0.0
Totalshopuk Ecommerce	Version 2.0.1
Totalshopuk Ecommerce	Version 2.0.2
Totalshopuk Ecommerce	Version 2.0.3
Totalshopuk Ecommerce	Version 2.1.0
Totalshopuk Ecommerce	Version 2.1.1