CVE-2017-6908

PoC —

CVSS 3.0

6.1 medium

EPSS

1%p66

Published

Mar 15, 2017 (Mar 15, 2017)

Modified

Jun 17, 2026

Description

An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Vendors: concrete5
Products: concrete5
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.