CVE-2017-6099

Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.

• CWE-79

• http://www.securityfocus.com/bid/96432Third Party Advisory, VDB Entry
• https://github.com/paypal/merchant-sdk-php/issues/129Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/96432Third Party Advisory, VDB Entry
• https://github.com/paypal/merchant-sdk-php/issues/129Exploit, Third Party Advisory

Published

Feb 24, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6090Unrestricted file upload vulnerability in clients/editclient…
• CVE-2017-6094CPEs used by subscribers on the access network receive their…
• CVE-2017-6095A SQL injection issue was discovered in the Mail Masta (aka …
• CVE-2017-6096A SQL injection issue was discovered in the Mail Masta (aka …
• CVE-2017-6097A SQL injection issue was discovered in the Mail Masta (aka …
• CVE-2017-6098A SQL injection issue was discovered in the Mail Masta (aka …
• CVE-2017-6100tcpdf before 6.2.0 uploads files from the server generating …
• CVE-2017-6102Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.
• CVE-2017-6103Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1…
• CVE-2017-6104Remote file upload vulnerability in Wordpress Plugin Mobile …
• CVE-2017-6127Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2017-6128An attacker may be able to cause a denial-of-service (DoS) a…