CVE-2015-2677

Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php.

• CWE-79

• http://ocportal.com/site/news/view/new-releases/ocportal-9-0-17-released.htmVendor Advisory
• http://ocportal.com/site/news/view/security_issues/xss-vulnerability-patch.htmPatch, Vendor Advisory
• http://packetstormsecurity.com/files/130729/ocPortal-9.0.16-Cross-Site-Scripting.htmlExploit
• http://www.securityfocus.com/archive/1/534817/100/0/threaded
• http://www.securitytracker.com/id/1031962
• http://ocportal.com/site/news/view/new-releases/ocportal-9-0-17-released.htmVendor Advisory
• http://ocportal.com/site/news/view/security_issues/xss-vulnerability-patch.htmPatch, Vendor Advisory
• http://packetstormsecurity.com/files/130729/ocPortal-9.0.16-Cross-Site-Scripting.htmlExploit
• http://www.securityfocus.com/archive/1/534817/100/0/threaded
• http://www.securitytracker.com/id/1031962

Published

Mar 23, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2671Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-2672The xsave/xrstor implementation in arch/x86/include/asm/xsav…
• CVE-2015-2673The ec_ajax_update_option and ec_ajax_clear_all_taxrates fun…
• CVE-2015-2674Restkit allows man-in-the-middle attackers to spoof TLS serv…
• CVE-2015-2675The OAuth implementation in librest before 0.7.93 incorrectl…
• CVE-2015-2676Cross-site request forgery (CSRF) vulnerability in the ASUS …
• CVE-2015-2678Multiple cross-site scripting (XSS) vulnerabilities in Metal…
• CVE-2015-2679Multiple SQL injection vulnerabilities in MetalGenix GeniXCM…
• CVE-2015-2680Cross-site request forgery (CSRF) vulnerability in MetalGeni…
• CVE-2015-2681Multiple cross-site scripting (XSS) vulnerabilities in the A…
• CVE-2015-2682Citrix Command Center before 5.1 Build 35.4 and 5.2 before B…
• CVE-2015-2683Citrix Command Center before 5.1 Build 35.4 and 5.2 before B…