CVE-2012-6720: Socialengine

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create, (2) location parameter to events/create, or (3) search parameter to widget/index/content_id/*.

Affected products

• Socialengine Socialengine: before 4.2.4 (fixed in 4.2.4)

Published 2020-02-11. Last modified 2026-06-16.