CVE-2012-1027: Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-...

Security readout for executives and security teams

CVE-2012-1027 is a cross-site scripting issue in ]project-open[ account closure handling. An attacker could cause a page to render attacker-controlled script or HTML through the message parameter. Business impact depends on whether the affected registration path is exposed and whether users with sensitive sessions can be targeted. ]project-open[ deployments running 3.4.x, 3.5.0.1-2, or nearby unverified versions are the likely exposure. Internet-facing registration or account-closed routes increase risk. Exposure is uncertain where this route is disabled, authenticated, customized, or already patched. Prioritize if ]project-open[ is internet-facing or used by privileged staff. The issue is old, but old exposed applications are often overlooked. If no affected deployment exists, track as informational and close with evidence. Mitigation focus: Check ]project-open[ vendor guidance and release notes for fixed versions.; Upgrade or retire affected 3.4.x and 3.5.0.1-2 deployments where possible.; Restrict or disable the affected registration/account-closed path if not needed..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.