Securimage HTML Injection

MEDIUM 6.1CVE-2017-14077 · GHSA-q6v4-xjp2-8ggv · Published 18/11/2017 · updated 17/06/2026

In short

CVE-2017-14077 is a MEDIUM (CVSS 6.1) vulnerability affecting dapphp/securimage, securimage (phpcaptcha).
Chance of exploitation in the next 30 days (EPSS): 0.81%, higher than 57.3% of all vulnerabilities.
Fix: update to 3.6.6 or later.

Package	Affected versions	Patched versions
dapphp/securimage Packagist	`< 3.6.6`	`3.6.6`
securimage phpcaptcha	`≤ 3.6.4`	No fix yet

Description

HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.

NVD description

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.

References

nvd.nist.gov/vuln/detail/CVE-2017-14077 · ADVISORY
dapphp/securimage commit 2c7ce3f · WEB
advisory.checkmarx.net/advisory/CX-2017-4223 · WEB
dapphp/securimage · PACKAGE
checkmarx.com/advisories/html-injection-securimage · WEB
checkmarx.com/advisories/html-injection-securimage · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free