CVE-2012-6720

Name of the Vulnerable Software and Affected Versions: SocialEngine versions prior to 4.2.4

Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the title parameter to "music/create", the location parameter to "events/create", or the search parameter to "widget/index/content id/*".

Recommendations: For versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints, such as "music/create", "events/create", and "widget/index/content id/*", until the update is applied. Avoid using the title, location, and search parameters in the respective endpoints until the issue is resolved.