CVE-2017-9451

Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in…

published June 6, 2017

CVSS
—
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00744 · 54.0th percentile
Published
2017-06-06T16:00Z
EPSS history
Timeline
  • 06 JUN 16:00Z
    Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in…
    cvelistv5