CVE-2017-6486

2017-03-0520:59:00

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.1%

JSON

A Cross-Site Scripting (XSS) issue was discovered in reasoncms before 4.7.1. The vulnerability exists due to insufficient filtration of user-supplied data (nyroModalSel) passed to the “reasoncms-master/www/nyroModal/demoSent.php” URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

CPENameOperatorVersion
reasoncmseq4.5.1
reasoncmseq4.0
reasoncmseq4.3
reasoncmseq4.4
reasoncmseq4.7
reasoncmseq4.7-rc.3
reasoncmseq4.2
reasoncmseq4.6
reasoncmseq4.7-rc
reasoncmseq4.7-rc.2

Name	Operator	Version
reasoncms	eq	4.5.1
reasoncms	eq	4.0
reasoncms	eq	4.3
reasoncms	eq	4.4
reasoncms	eq	4.7
reasoncms	eq	4.7-rc.3
reasoncms	eq	4.2
reasoncms	eq	4.6
reasoncms	eq	4.7-rc
reasoncms	eq	4.7-rc.2