CVE-2017-12439 SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML co...
HighCVSS 7.5
EPSS 0.64%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated redirection issues.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| socusoft flash slideshow maker | <= 5.20 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry