CVE-2017-14957: Blogotext Project Blogotext

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for example) change global settings or create/delete posts. It is also possible to execute JavaScript against unauthenticated users of the blog.

Affected products

• Blogotext Project Blogotext: up to and including 3.7.5

Published 2017-10-02. Last modified 2026-06-17.