CVE-2017-6909

An issue was discovered in Shimmie <= 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

• CWE-79

• http://www.securityfocus.com/bid/96932Third Party Advisory, VDB Entry
• https://github.com/shish/shimmie2/issues/597Issue Tracking, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/96932Third Party Advisory, VDB Entry
• https://github.com/shish/shimmie2/issues/597Issue Tracking, Patch, Third Party Advisory

Published

Mar 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6902Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-6903In ioquake3 before 2017-03-14, the auto-downloading feature …
• CVE-2017-6905An issue was discovered in concrete5 <= 5.6.3.4. The vulnera…
• CVE-2017-6906An issue was discovered in SiberianCMS before 4.10.0. The v…
• CVE-2017-6907An issue was discovered in Open.GL before 2017-03-13. The vu…
• CVE-2017-6908An issue was discovered in concrete5 <= 5.6.3.4. The vulnera…
• CVE-2017-6910The HTTP and WebSocket engine components in the server in Ka…
• CVE-2017-6911USB Pratirodh is prone to sensitive information disclosure. …
• CVE-2017-6912Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected…
• CVE-2017-6913Cross-site scripting (XSS) vulnerability in the Open-Xchange…
• CVE-2017-6914CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id par…
• CVE-2017-6915CSRF exists in BigTree CMS 4.1.18 with the colophon paramete…