CVE-2017-17933

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry

Timeline

Published: Dec 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-179346.5ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandli CVE-2017-179357.5The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows rem CVE-2017-179368.8Vanguard Marketplace Digital Products PHP has CSRF via /search.CVE-2017-179376.1Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.CVE-2017-179384.8PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.CVE-2017-179398.8PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.CVE-2017-17947.5IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible den CVE-2017-179404.8PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.CVE-2017-179417.2PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.CVE-2017-179428.8In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.CVE-2017-179449.1The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.CVE-2017-179459.1The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.