CVE-2017-7986

In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components.

• CWE-79

• http://www.securityfocus.com/bid/98024Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/686-20170404-core-xss-vulnerabilityPatch, Vendor Advisory
• http://www.securityfocus.com/bid/98024Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/686-20170404-core-xss-vulnerabilityPatch, Vendor Advisory

Published

Apr 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7980Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator …
• CVE-2017-7981Tuleap before 9.7 allows command injection via the PhpWiki 1…
• CVE-2017-7982Integer overflow in the plist_from_bin function in bplist.c …
• CVE-2017-7983In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent u…
• CVE-2017-7984In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7985In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7987In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7988In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7989In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7990The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks …
• CVE-2017-7991Exponent CMS 2.4.1 and earlier has SQL injection via a base6…
• CVE-2017-7992Heartland Payment Systems Payment Gateway PHP SDK hps/heartl…