onyx

onyx --cves cve-2012-4871

CVE-2012-4871

MEDPOCLiteSpeed Web Server
score
<0.1
cvss
4.3
epss
1.6%
published
2012-09-06
kev added
—
first seen

LiteSpeed Web Server 4.1.11 contains a reflected cross-site scripting caused by unsanitized input in service/graph_html.php in the administrator panel, letting remote attackers inject arbitrary web script or HTML via the gtitle parameter, exploit requires sending crafted requests.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2012-09-06 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: http://packetstormsecurity.org/files/110974/LiteSpeed-4.1.11-Cross-Site-Scripting.htmlXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 1.6%2026-09-23: epss 1.6%2026-09-24: epss 1.6%2026-09-25: epss 1.6%2026-09-26: epss 1.6%2026-09-27: epss 1.6%2026-09-28: epss 1.6%2026-09-29: epss 1.6%2026-09-30: epss 1.6%2026-10-01: epss 1.6%2026-10-02: epss 1.6%2026-10-03: epss 1.6%2026-10-04: epss 1.6%2026-10-05: epss 1.6%2026-10-06: epss 1.6%2026-10-07: epss 1.6%2026-10-08: epss 1.6%2026-10-09: epss 1.6%2026-10-10: epss 1.6%2026-10-11: epss 1.6%2026-10-12: epss 1.6%2026-10-13: epss 1.6%2026-10-14: epss 1.6%2026-10-15: epss 1.6%2026-10-16: epss 1.6%2026-10-18: epss 1.6%2026-10-19: epss 1.6%2026-10-20: epss 1.6%2026-10-21: epss 1.6%1.6%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC http://packetstormsecurity.org/files/110974/LiteSpeed-4.1.11-Cross-Site-Scripting.html

Exploit availability

Weaknesses

CWE-79

References 4