CVE-2017-6491

2017-03-0520:59:00

Google

osv.dev

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.2%

JSON

Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (tooltip_id, callback, args, cid) passed to the EPESI-master/modules/Utils/Tooltip/req.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

CPENameOperatorVersion
epesicrmeq1.6.4
epesicrmeq1.7.2
epesicrmeq1.6.0
epesicrmeq1.5.6.1
epesicrmeq1.6.5
epesicrmeq1.7.0
epesicrmeq1.8.1.1
epesicrmeq1.5.5
epesicrmeq1.6.2.1
epesicrmeq1.6.2

Name	Operator	Version
epesicrm	eq	1.6.4
epesicrm	eq	1.7.2
epesicrm	eq	1.6.0
epesicrm	eq	1.5.6.1
epesicrm	eq	1.6.5
epesicrm	eq	1.7.0
epesicrm	eq	1.8.1.1
epesicrm	eq	1.5.5
epesicrm	eq	1.6.2.1
epesicrm	eq	1.6.2