CVE-2017-12905
10.0
CRITICAL · CVSS 3.1 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (10), but no sign of active exploitation.
Description
Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.
Scoring
| CVSS | 10.0 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 2.64% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-918 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-09-25 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| vebto | pixie - image editor |
References
→ the Explorer · watch your stack · NVD