CVE-2017-17940

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 28, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-179417.2PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.CVE-2017-179428.8In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.CVE-2017-179449.1The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.CVE-2017-179459.1The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.CVE-2017-179469.8A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" dataCVE-2017-179474.8A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R1CVE-2017-179486.1Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.CVE-2017-179496.1Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.CVE-2017-17954.4IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSpCVE-2017-179508.8Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.CVE-2017-179519.8PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.CVE-2017-179528.6PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an
CVE-2017-17940: Medium severity, CVSS 4.8 | Vulnix