GCVE - cpe:2.3:a:elgg:elgg:1.7.11:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:elgg:elgg:1.7.11:*:*:*:*:*:*:*

part: a version: 1.7.11 update: *

Vendor	Elgg (`c1a09d46-05f3-5975-aca5-4318fa0a4ba0`)
Product	Elgg (`1e05ed73-59f6-5d0b-9239-1fb3fdd4afa6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/elgg/elgg`	purl2cpe	2026-06-01 10:16:00.721521
`pkg:rpm/opensuse/elgg`	purl2cpe	2026-06-01 10:16:00.721523
`pkg:sourceforge/elgg`	purl2cpe	2026-06-01 10:16:00.721525

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-0234`	vulnerable	2026-06-08 05:03:46.278293	Details available Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save. Published: 2014-02-02T20:00:00.000Z Updated: 2024-08-06T14:18:09.479Z Open on db.gcve.eu Reference links http://blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717 http://packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html https://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21 http://seclists.org/fulldisclosure/2013/Jan/251 https://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6563`	vulnerable	2026-06-08 05:03:01.081289	Details available engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors. Published: 2013-05-23T15:00:00.000Z Updated: 2024-08-06T21:36:01.037Z Open on db.gcve.eu Reference links http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released http://secunia.com/advisories/49129 http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip http://www.securityfocus.com/bid/53623 https://exchange.xforce.ibmcloud.com/vulnerabilities/75757	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6562`	vulnerable	2026-06-08 05:03:01.080471	Details available engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts. Published: 2013-05-23T15:00:00.000Z Updated: 2024-08-06T21:36:00.283Z Open on db.gcve.eu Reference links http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released http://secunia.com/advisories/49129 http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip http://www.securityfocus.com/bid/53623 https://exchange.xforce.ibmcloud.com/vulnerabilities/75757	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6561`	vulnerable	2026-06-08 05:03:01.074356	Details available Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information. Published: 2013-05-23T15:00:00.000Z Updated: 2024-08-06T21:36:00.314Z Open on db.gcve.eu Reference links http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released http://secunia.com/advisories/49129 http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip http://www.securityfocus.com/bid/53623 https://exchange.xforce.ibmcloud.com/vulnerabilities/75756	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.