CVE-2017-11651

NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag...

CVE-2017-11651

CVE-2017-11651 affects NexusPHP V1.5 with a cross-site scripting (XSS) flaw. The issue arises from a vulnerability in the UBBCode url tag that accepts javascript: or data: URLs, allowing injection of arbitrary web script or HTML. Public references include CNVD-2017-26595 and NVD/NIST records. Exp...