CVE-2017-1000051

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the pad content

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.cryptpad.fr/2017/03/06/Security-growing-pains/Third Party Advisory
https://github.com/xwiki-labs/cryptpad/releases/tag/1.1.1Release Notes, Third Party Advisory
https://blog.cryptpad.fr/2017/03/06/Security-growing-pains/Third Party Advisory
https://github.com/xwiki-labs/cryptpad/releases/tag/1.1.1Release Notes, Third Party Advisory

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10000527.8Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow user CVE-2017-10000538.1Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Sess CVE-2017-10000546.1Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.CVE-2017-10000569.8Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to CVE-2017-10000586.1Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.CVE-2017-10000596.1Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any CVE-2017-10000609.8EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root CVE-2017-10000617.1xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible informat CVE-2017-10000627.5kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution CVE-2017-10000636.1kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure CVE-2017-10000647.5kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS CVE-2017-10000656.1Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionalit