CVE-2012-5452: Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject a...

Security readout for executives and security teams

CVE-2012-5452 describes multiple cross-site scripting flaws in Subrion CMS 2.2.1. An attacker could inject script or HTML into listed CMS fields or search parameters. Business risk depends on whether affected Subrion instances still exist, whether admin features are exposed, and whether untrusted users can reach vulnerable inputs. Exposure is most likely in legacy Subrion CMS 2.2.1 deployments. The advsearch vectors may extend to 2.2.2, but the source bundle presents that as uncertain. Organizations not running Subrion, or running clearly remediated later versions, are unlikely to be affected. Address this during legacy web-application cleanup, with higher urgency if Subrion is internet-facing or used by administrators handling sensitive content. It is not KEV-listed and has no supplied CVSS, but public disclosure and old CMS exposure increase practical risk. Mitigation focus: Inventory all public and internal Subrion CMS deployments and versions.; Prioritize removal or upgrade of Subrion CMS 2.2.1 instances.; Check Subrion vendor guidance and release notes before relying on 2.2.2..

Prepared

Jun 24, 2026, 19:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.