CVE-2012-5357

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

67.78%

Published

Oct 30, 2017

Modified

May 12, 2026

Public PoC / Exploit (1)

All weaponized →

Exploit-DBEktron 8.02 - XSLT Transform Remote Code Execution (Metasploit)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.

Weaknesses (CWE)

CWE-19

Affected Products (1)

ektron · ektron_content_management_systemvulnerable

References (8)

http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm

Issue TrackingVendor Advisory

https://technet.microsoft.com/library/security/msvr12-016

Issue TrackingRelease NotesThird Party Advisory

https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/

ExploitIssue TrackingThird Party Advisory

https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_exec

ExploitIssue TrackingThird Party Advisory

http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm

Issue TrackingVendor Advisory

https://technet.microsoft.com/library/security/msvr12-016

Issue TrackingRelease NotesThird Party Advisory

https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/

ExploitIssue TrackingThird Party Advisory

https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_exec

ExploitIssue TrackingThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs