CVE-2012-2903: Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attack...

Security readout for executives and security teams

CVE-2012-2903 is a cross-site scripting issue in PHP Address Book 7.0 and earlier. A remote attacker could inject script or HTML through specific request paths or parameters, potentially affecting users who view generated pages. This matters mainly for organizations still running this old address book application. Exposure is likely limited to environments still running PHP Address Book 7.0 or earlier, especially if reachable by untrusted users. The bundle does not identify package names, CPEs, hosted service variants, or downstream products. Treat this as a legacy web application risk. It is not listed as actively exploited in the provided evidence, but public-facing old PHP apps can create account and data exposure if left unmaintained. Mitigation focus: Inventory PHP Address Book deployments and confirm whether versions are 7.0 or earlier.; Check project or vendor guidance for a fixed release or official workaround.; If no maintained fix exists, retire, replace, or isolate the application..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.