CVE-2017-12906

Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) cheaters.php or (2) confirm_resend.php.

• CWE-79

• http://loid.online/cve/cve.txtExploit, Third Party Advisory, URL Repurposed
• http://www.sstrunk.com/cve/confirm_resend.htmlThird Party Advisory
• http://loid.online/cve/cve.txtExploit, Third Party Advisory, URL Repurposed
• http://www.sstrunk.com/cve/confirm_resend.htmlThird Party Advisory

Published

Sep 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1290IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable t…
• CVE-2017-12900Several protocol parsers in tcpdump before 4.9.2 could cause…
• CVE-2017-12901The EIGRP parser in tcpdump before 4.9.2 has a buffer over-r…9.8
• CVE-2017-12902The Zephyr parser in tcpdump before 4.9.2 has a buffer over-…9.8
• CVE-2017-12904Improper Neutralization of Special Elements used in an OS Co…
• CVE-2017-12905Server Side Request Forgery vulnerability in Vebto Pixie Ima…10
• CVE-2017-12907Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 v…
• CVE-2017-12908SQL injection vulnerability in takeconfirm.php in NexusPHP 1…
• CVE-2017-12909SQL injection vulnerability in modtask.php in NexusPHP 1.5 a…
• CVE-2017-1291IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTT…
• CVE-2017-12910SQL injection vulnerability in massmail.php in NexusPHP 1.5 …
• CVE-2017-12911The "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability …