CVE-2012-5873: ARC2 Project ARC2

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.

Affected products

• ARC2 Project ARC2: up to and including 2011-12-01

Published 2023-04-26. Last modified 2026-06-16.