CVE-2017-9306 inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.
MediumCVSS 6.1
EPSS 0.93%
- Published
- Updated
- Exploit status
- No public exploit known
Description
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| syspass | = 2.1.9 | No fix listed |
References
- www.cdxy.me exploit third-party-advisory