CVE-2017-17939

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 28, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-17947.5IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible denCVE-2017-179404.8PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.CVE-2017-179417.2PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.CVE-2017-179428.8In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.CVE-2017-179449.1The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.CVE-2017-179459.1The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.CVE-2017-179469.8A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" dataCVE-2017-179474.8A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R1CVE-2017-179486.1Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.CVE-2017-179496.1Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.CVE-2017-17954.4IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSpCVE-2017-179508.8Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.
CVE-2017-17939: High severity, CVSS 8.8 | Vulnix