Security readout for executives and security teams
CVE-2012-3830 is a cross-site scripting flaw in php-decoda before 3.3.3. If a site lets users submit Decoda video tags, an attacker could inject script or HTML into pages viewed by others. Business risk is mainly account abuse, session theft, or brand damage where affected markup is exposed to users. Exposure is likely limited to applications using php-decoda before 3.3.3 and rendering user-controlled video directives. Sites that do not accept untrusted Decoda markup, or do not use the video template, are less likely exposed. Treat as a targeted remediation item for legacy PHP applications. It is not flagged as actively exploited in the provided sources, but internet-facing user-content features should be upgraded promptly because XSS can affect customer trust and account security. Mitigation focus: Upgrade php-decoda to version 3.3.3 or later.; Review the referenced upstream commits before backporting a local patch.; Restrict untrusted users from submitting Decoda video directives until remediated..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2012-3830 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- decoda-decoda-xss(75333)CVE reference · vdb-entry, x_refsource_XF
- https://github.com/milesj/php-decoda/commit/4068257bb4e1071d1d60577289d3da922c296c83CVE reference · x_refsource_CONFIRM
- https://github.com/milesj/php-decoda/commit/666778f326dff3bd213be9f624f0fcb337c0b4c9CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.