CVE-2018-17861

A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the wsdlLib parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-79

• http://packetstormsecurity.com/files/151945/SAP-J2EE-Engine-7.01-Portal-EPP-Protocol-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Mar/6Mailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Mar/4Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/151945/SAP-J2EE-Engine-7.01-Portal-EPP-Protocol-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Mar/6Mailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Mar/4Mailing List, Third Party Advisory

Published

Aug 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17856An issue was discovered in Joomla! before 3.8.13. com_joomla…
• CVE-2018-17857An issue was discovered in Joomla! before 3.8.13. Inadequate…
• CVE-2018-17858An issue was discovered in Joomla! before 3.8.13. com_instal…
• CVE-2018-17859An issue was discovered in Joomla! before 3.8.13. Inadequate…
• CVE-2018-1786IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes i…5.3
• CVE-2018-17860Cloudera CDH has Insecure Permissions because ALL cannot be …7.2
• CVE-2018-17862A cross-site scripting (XSS) vulnerability in SAP J2EE Engin…6.1
• CVE-2018-17865A cross-site scripting (XSS) vulnerability in SAP J2EE Engin…6.1
• CVE-2018-17866Multiple cross-site scripting (XSS) vulnerabilities in inclu…
• CVE-2018-17867The Port Forwarding functionality on DASAN H660GW devices al…
• CVE-2018-17868DASAN H660GW devices have Stored XSS in the Port Forwarding …
• CVE-2018-17869DASAN H660GW devices do not implement any CSRF protection me…