CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

PT-2017-12552

Name of the Vulnerable Software and Affected Versions SocuSoft Flash Slideshow Maker Professional versions prior to v5.21 Description The issue arises when the advanced configuration is used, and the xml path HTTP parameter trusts user-supplied input. This is compounded by an unsafe XML...

CVE-2017-12439: Cross-Site Request Forgery (CSRF)

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...