Pi Cross-site Scripting vulnerability

보통 6.1CVE-2017-7251 · GHSA-9v3w-m552-m6ff · Published 23/03/2017 · updated 17/06/2026

요약

CVE-2017-7251은(는) pi/pi, pi (piengine)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.98%, 전체 취약점의 62.4%보다 높음.
조치: 2.6.0-alpha1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pi/pi Packagist	`< 2.6.0-alpha1`	`2.6.0-alpha1`
pi piengine	`≤ 2.5.0`	No fix yet

Description

A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the pi-develop/www/script/editor/markitup/preview/markdown.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

NVD description

A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

References

nvd.nist.gov/vuln/detail/CVE-2017-7251 · ADVISORY
pi-engine/pi · WEB
pi-engine/pi commit 557cd05 · WEB
pi-engine/pi · PACKAGE
web.archive.org/web/20210124010656/https://www.securityfocus.com/bid/97061 · WEB
securityfocus.com/bid/97061 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pi/pi

Packagist

< 2.6.0-alpha1

2.6.0-alpha1

piengine

≤ 2.5.0

No fix yet

Description

NVD description