CVE-2017-1000188

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10001897.5nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()CVE-2017-10001909.1SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.CVE-2017-10001917.5Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS.CVE-2017-10001929.8Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacCVE-2017-10001936.1October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim'CVE-2017-10001949.8October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possCVE-2017-10001957.5October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by fileCVE-2017-10001969.8October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly otherCVE-2017-10001979.8October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on CVE-2017-10001987.5tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of sCVE-2017-10001997.5tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able CVE-2017-100025.4Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Settings and Config
CVE-2017-1000188: Medium severity, CVSS 6.1 | Vulnix