CVE-2017-9548

admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication (aka a pending page change).

• CWE-79

• https://github.com/bigtreecms/BigTree-CMS/issues/296Issue Tracking, Patch, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/issues/296Issue Tracking, Patch, Third Party Advisory

Published

Jun 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9542D-Link DIR-615 Wireless N 300 Router allows authentication b…
• CVE-2017-9543register.ghp in EFS Software Easy Chat Server versions 2.0 t…7.5
• CVE-2017-9544There is a remote stack-based buffer overflow (SEH) in regis…9.8
• CVE-2017-9545The next_text function in src/libmpg123/id3.c in mpg123 1.24…
• CVE-2017-9546admin.php in BigTree through 4.2.18 allows remote authentica…
• CVE-2017-9547admin.php in BigTree through 4.2.18 has a Cross-site Scripti…
• CVE-2017-9551Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16…
• CVE-2017-9552A design flaw in authentication in Synology Photo Station 6.…
• CVE-2017-9553A design flaw in SYNO.API.Encryption in Synology DiskStation…
• CVE-2017-9554An information exposure vulnerability in forget_passwd.cgi i…
• CVE-2017-9555Cross-site scripting (XSS) vulnerability in PixlrEditorHandl…
• CVE-2017-9556Cross-site scripting (XSS) vulnerability in Video Metadata E…