Executive brief
Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
Affected products
- PyPI Zope
Junglewise Threat Intelligence
PYSEC-2017-148 - Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.
Severity: low · CVSS 3 · Published 2017-08-07
Technologies: Zope (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2326 - Access control vulnerable to user data deletion by anonynmous users
- PYSEC-2026-2325 - Information disclosure in AccessControl
- PYSEC-2026-2077 - Zope vulnerable to Stored Cross Site Scripting with SVG images
- PYSEC-2026-760 - Zope DocumentTemplate package allows unauthenticated write
- PYSEC-2026-761 - Zope Server vulnerable to DoS via header injection