CVE-2017-6536

CVE-2017-6536 describes multiple Cross-Site Scripting (XSS) vulnerabilities in webpagetest 3.0, specifically within the webpagetest-master/www/weblite.php URL. These flaws stem from inadequate sanitization of user-supplied data, such as 'url' and 'pssid' parameters. An attacker could leverage these issues to inject and execute arbitrary HTML and script code within a victim's browser, operating in the context of the vulnerable website. Rated as Medium severity (CVSS 6.1), the vulnerability requires no authentication and low attack complexity, but user interaction is needed for successful exploitation. The potential impact includes limited confidentiality and integrity compromise. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.