CVE-2017-14957

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for example) change global settings or create/delete posts. It is also possible to execute JavaScript against unauthenticated users of the blog.

• CWE-79

• http://openwall.com/lists/oss-security/2017/10/01/1Mailing List, Patch, Third Party Advisory
• https://github.com/BlogoText/blogotext/issues/318Issue Tracking, Patch, Third Party Advisory
• https://github.com/BlogoText/blogotext/pull/320/commits/1a283cc8ad2cda37e0a6aff8f4558b98ecbfd9c2Issue Tracking, Patch, Third Party Advisory
• https://github.com/BlogoText/blogotext/releases/tag/3.7.6Patch, Release Notes, Third Party Advisory
• http://openwall.com/lists/oss-security/2017/10/01/1Mailing List, Patch, Third Party Advisory
• https://github.com/BlogoText/blogotext/issues/318Issue Tracking, Patch, Third Party Advisory
• https://github.com/BlogoText/blogotext/pull/320/commits/1a283cc8ad2cda37e0a6aff8f4558b98ecbfd9c2Issue Tracking, Patch, Third Party Advisory
• https://github.com/BlogoText/blogotext/releases/tag/3.7.6Patch, Release Notes, Third Party Advisory

Published

Oct 2, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1495IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could …
• CVE-2017-14952Double free in i18n/zonemeta.cpp in International Components…
• CVE-2017-14953HikVision Wi-Fi IP cameras, when used in a wired configurati…
• CVE-2017-14954The waitid implementation in kernel/exit.c in the Linux kern…
• CVE-2017-14955Check_MK before 1.2.8p26 mishandles certain errors within th…5.9
• CVE-2017-14956AlienVault USM v5.4.2 and earlier offers authenticated users…
• CVE-2017-14958lib.php in PivotX 2.3.11 does not properly block uploads of …
• CVE-2017-1496IBM Sterling B2B Integrator Standard Edition 5.2.x is vulner…
• CVE-2017-14960xDashboard in OpenText Document Sciences xPression (formerly…
• CVE-2017-14961In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains…
• CVE-2017-14962In IKARUS anti.virus before 2.16.18, the ntguard.sys driver …
• CVE-2017-14963In IKARUS anti.virus before 2.16.18, the ntguard.sys driver …