VULNERABILITY INTELLIGENCE
CVE-2011-3642
CVSS score9.6 CRITICAL
EPSS probability8.75%
CISA KEVNot currently listed
Published2020-02-08
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
Weakness classification
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Primary references
- cve@mitre.org — Broken Link
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory