CVE-2018-17053

Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054.

• CWE-79

• https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/Exploit, Third Party Advisory
• https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018Vendor Advisory
• https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/Exploit, Third Party Advisory
• https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018Vendor Advisory

Published

Oct 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17046translate man before 2018-08-21 has XSS via containers/outpu…
• CVE-2018-17048admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangf…
• CVE-2018-17049CQU-LANKERS through 2017-11-02 has XSS via the public/api.ph…
• CVE-2018-1705IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spect…6.5
• CVE-2018-17050The mintToken function of a smart contract implementation fo…
• CVE-2018-17051K-Net Cisco Configuration Manager through 2014-11-19 has XSS…
• CVE-2018-17054Cross-site scripting (XSS) vulnerability in Identity Server …
• CVE-2018-17055An arbitrary file upload vulnerability in Progress Sitefinit…
• CVE-2018-17056Cross-site scripting (XSS) vulnerability in ServiceStack in …
• CVE-2018-17057An issue was discovered in TCPDF before 6.2.22. Attackers ca…
• CVE-2018-17058An issue was discovered in JABA XPress Online Shop through 2…8.8
• CVE-2018-1706IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site sc…5.4