CVE-2017-16514

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-10 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in the application.

Affected products

WebsiteBaker: 2.10.0

References

https://gist.github.com/anonymous/13df19c04c7e86c0f5256b91376d593a
https://gist.github.com/anonymous/13df19c04c7e86c0f5256b91376d593a

Get alerted when CVE-2017-16514 or the next vulnerability affects your stack