CVE-2012-5296: Multiple cross-site scripting (XSS) vulnerabilities in Mavili Guestbook, as released in November 2007, allo...

Security readout for executives and security teams

CVE-2012-5296 describes cross-site scripting in Mavili Guestbook, a legacy guestbook application released in November 2007. A remote attacker could inject script or HTML through an id parameter on named ASP pages. The source bundle does not provide severity scoring, affected version detail, patch status, or evidence of active exploitation. Exposure is likely limited to organizations still running Mavili Guestbook or preserved legacy ASP endpoints with those page names. The provided affected-product metadata is incomplete, so asset discovery should confirm the application, route names, and whether the id parameter is reachable from untrusted users. Prioritize discovery first. This is old software with incomplete scoring and no active-exploitation evidence, but internet-facing legacy guestbooks can create customer-facing script injection risk. Remediate quickly if the application is still deployed publicly. Mitigation focus: Inventory public sites for Mavili Guestbook and the named ASP endpoints.; Check vendor or project guidance before assuming any patch exists.; Retire or replace the guestbook if no maintained fix is available..

Prepared

Jun 27, 2026, 16:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.