CVE-2017-16636

In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are able to bypass the basic editor validation to trigger cross site scripting. The XSS is persistent and the request method to inject via editor is GET. To save the editor context, the followup POST method request must be processed to perform the attack via the application side. The basic validation of the editor does not allow injecting script codes and blocks the context. Attackers can inject the code by using an editor tag that is not recognized by the basic validation. Thus allows a restricted user account to inject malicious script code to perform a persistent attack against higher privilege web-application user accounts.

• CWE-79

• https://www.vulnerability-lab.com/get_content.php?id=2000Exploit, Issue Tracking, Third Party Advisory
• https://www.vulnerability-lab.com/get_content.php?id=2000Exploit, Issue Tracking, Third Party Advisory

Published

Nov 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16630In SapphireIMS 4097_1, a guest user can create a local admin…8.8
• CVE-2017-16631In SapphireIMS 4097_1, a guest user is able to change the pa…6.5
• CVE-2017-16632In SapphireIMS 4097_1, the password in the database is store…7.5
• CVE-2017-16633In Joomla! before 3.8.2, a logic bug in com_fields exposed r…
• CVE-2017-16634In Joomla! before 3.8.2, a bug allowed third parties to bypa…
• CVE-2017-16635In TinyWebGallery v2.4, an XSS vulnerability is located in t…
• CVE-2017-16637In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11…
• CVE-2017-16638The Gentoo net-misc/vde package before version 2.3.2-r4 may …
• CVE-2017-16639Tor Browser on Windows before 8.0 allows remote attackers to…
• CVE-2017-1664IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weak…
• CVE-2017-16641lib/rrd.php in Cacti 1.1.27 allows remote authenticated admi…
• CVE-2017-16642In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.…