CVE-2017-15947

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-159484.8Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with theCVE-2017-159497.2Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admiCVE-2017-15955.5IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vecCVE-2017-159507.8Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flCVE-2017-159517.8The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "neCVE-2017-159535.5bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cueCVE-2017-159545.5bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when CVE-2017-159555.5bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when procesCVE-2017-159567.5ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.CVE-2017-159578.8my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.CVE-2017-159589.8D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.CVE-2017-159599.8Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576.
CVE-2017-15947: Medium severity, CVSS 5.4 | Vulnix