CVE-2017-15092

—

CVSS 3.0

6.1 medium

EPSS

2%p82

Published

Jan 23, 2018 (Jan 23, 2018)

Modified

Jun 17, 2026

Description

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

Vendors: powerdns
Products: recursor
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.3%)

In the news0 stories

No ingested article mentions this CVE yet.