CVE-2017-5494

2017-01-1522:59:00

Google

osv.dev

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.

CPENameOperatorVersion
b2evolutioneq6.5.0
b2evolutioneq6.6.4
b2evolutioneq5.2.0-stable
b2evolutioneq6.4.4-beta
b2evolutioneq6.1.2-alpha
b2evolutioneq6.4.2-beta
b2evolutioneq6.6.8
b2evolutioneq6.7.9
b2evolutioneq6.0.0-alpha
b2evolutioneq6.7.4

Name	Operator	Version
b2evolution	eq	6.5.0
b2evolution	eq	6.6.4
b2evolution	eq	5.2.0-stable
b2evolution	eq	6.4.4-beta
b2evolution	eq	6.1.2-alpha
b2evolution	eq	6.4.2-beta
b2evolution	eq	6.6.8
b2evolution	eq	6.7.9
b2evolution	eq	6.0.0-alpha
b2evolution	eq	6.7.4