CVE-2017-11175

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 5, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-111767.8The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a usCVE-2017-111777.5TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory.CVE-2017-111787.5In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents anCVE-2017-111796.1FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user accoCVE-2017-11187.5IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configureCVE-2017-111806.1FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of anCVE-2017-111815.4In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable.CVE-2017-111825.4In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable.CVE-2017-111834.9front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter.CVE-2017-111849.8SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.CVE-2017-111857.5The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) vCVE-2017-111879.8phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
CVE-2017-11175: Medium severity, CVSS 6.1 | Vulnix