CVE-2017-16356

Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by having them visit a plugins/content/sige/plugin_sige/print.php link with a crafted img, name, or caption parameter.

CVSS v3.0

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.19% chance of exploitation in the next 30 days, 81th percentile

Published

2018-02-20

Updated

2024-08-05

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/146422/Joomla-Kubik-Rubik-SIGE-3.2.3-Cross-Site-Scri…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44104

References

• CVE Record
• NVD entry

Related

• CVE-2017-16353
• CVE-2017-16357
• CVE-2017-16352
• CVE-2017-16510
• CVE-2017-1635
• CVE-2017-16513