CVE-2012-5872: ARC2 Project ARC2

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.

Affected products

• ARC2 Project ARC2: up to and including 2011-12-01

Published 2023-04-26. Last modified 2026-06-16.