GeSHi vulnerable to Cross-site Scripting

MEDIUM 4.3CVE-2012-3522 · GHSA-f3f3-5q5j-6v47 · Published 13/06/2014 · updated 16/06/2026

In short

CVE-2012-3522 is a MEDIUM (CVSS 4.3) vulnerability affecting geshi/geshi, geshi (qbnz).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.3% of all vulnerabilities.
Fix: update to 1.0.8.11 or later.

Package	Affected versions	Patched versions
geshi/geshi Packagist	`< 1.0.8.11`	`1.0.8.11`
geshi qbnz	`= 1.0.8.4= 1.0.8.5= 1.0.8.6= 1.0.8.7= 1.0.8.8= 1.0.8.9≤ 1.0.8.10`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

NVD description

Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

More vulnerabilities in geshi/geshi

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free