Unspecified input is not properly sanitised before being returned to the user via a "standard_error_message" template. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities are reported in version 2.12.2, 2.11.5 and 2.10.21. Other versions may also be affected. Once the vulnerability is confirmed by Core Impact, if you want to check this exploit manually, replace the "REPLACE" keyword with "%80".
Exploit Type
Product Name