CVE-2017-17693

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/d4wner/Vulnerabilities-Report/blob/master/Techno-Portfolio-Management-Panel.mdExploit, Third Party Advisory
https://github.com/d4wner/Vulnerabilities-Report/blob/master/Techno-Portfolio-Management-Panel.mdExploit, Third Party Advisory

Timeline

Published: Dec 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-176945.4Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.CVE-2017-176958.8Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.CVE-2017-176964.3Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.CVE-2017-176978.6The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.CVE-2017-176986.1Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.CVE-2017-176999.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.CVE-2017-177009.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.CVE-2017-177019.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.CVE-2017-177036.1Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.CVE-2017-177047.4A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Eth CVE-2017-177078.1Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleas CVE-2017-177084.3Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Pas