CVE-2017-9441

Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.

• CWE-79

• https://github.com/bigtreecms/BigTree-CMS/issues/290Issue Tracking, Patch, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/issues/290Issue Tracking, Patch, Third Party Advisory

Published

Jun 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9435Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injecti…
• CVE-2017-9436TeamPass before 2.1.27.4 is vulnerable to a SQL injection in…
• CVE-2017-9437Openbravo Business Suite 3.0 is affected by SQL injection. T…
• CVE-2017-9438libyara/re.c in the regexp module in YARA 3.5.0 allows remot…
• CVE-2017-9439In ImageMagick 7.0.5-5, a memory leak was found in the funct…
• CVE-2017-9440In ImageMagick 7.0.5-5, a memory leak was found in the funct…
• CVE-2017-9442BigTree CMS through 4.2.18 allows remote authenticated users…
• CVE-2017-9443BigTree CMS through 4.2.18 allows remote authenticated users…8.8
• CVE-2017-9444BigTree CMS through 4.2.18 has CSRF related to the core\admi…
• CVE-2017-9445In systemd through 233, certain sizes passed to dns_packet_n…7.5
• CVE-2017-9447In the web interface of Parallels Remote Application Server …
• CVE-2017-9448Cross-site scripting (XSS) vulnerabilities in BigTree CMS th…