CVE-2012-0767

Adobe Flash Player, now end-of-life, contains a cross-site scripting vulnerability actively exploited in the wild, posing a significant risk to systems still running it despite its discontinuation and lack of updates.

CVE-2012-0767 allows remote attackers to inject scripts and HTML, potentially leading to data theft or system compromise. DIB organizations must immediately identify and remove any remaining Flash Player installations to avoid persistent exploitation and non-compliance with NIST 800-171. Failure to do so creates a perpetual security liability.

Shame score — The continued exploitation of a known vulnerability in a discontinued product demonstrates a failure to maintain a basic security posture and highlights the risks of relying on unsupported software.