CVE-2012-5537

Published: Dec 3, 2012Modified: Apr 29, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.

Affected (8)

Products: Simplenews Scheduler Project: Simplenews Scheduler

Simplenews Scheduler Project

1 product

Simplenews Scheduler

Configuration A

8 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.0
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.0 beta2
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.0 beta3
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.0 beta4
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.1
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.2
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.3
Simplenews Scheduler Project Simplenews Scheduler	Version 6.x-2.x dev