Foswiki · Foswiki · CVE-2012-1004
**Name of the Vulnerable Software and Affected Versions**
Foswiki versions prior to 1.1.5
**Description**
The issue allows remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via various parameters, including `text`, `FirstName`, `LastName`, `OrganisationName`, `OrganisationUrl`, `Profession`, `Country`, `State`, `Address`, `Location`, `Telephone`, `VoIP`, `InstantMessagingIM`, `Email`, `HomePage`, or `Comment`.
**Recommendations**
For versions prior to 1.1.5, update to version 1.1.5 or later to resolve the issue. As a temporary workaround, consider restricting the CHANGE privileges to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected UI/Register.pm module until the issue is resolved.