CVE-2017-6540

CVE-2017-6540 describes multiple Cross-Site Scripting (XSS) vulnerabilities in WebPageTest 3.0, specifically within the webpagetest-master/www/benchmarks/compare.php URL. These flaws stem from inadequate sanitization of user-supplied configuration data. An attacker could exploit this to inject and execute arbitrary HTML and script code in a user's browser, within the context of the vulnerable website. The vulnerability carries a CVSSv3 score of 6.1 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to limited impact on confidentiality and integrity. While not actively exploited in the wild (no KEV entry), its EPSS score is low, suggesting a minimal probability of future exploitation. There is no publicly available exploit code in Metasploit, Nuclei, or ExploitDB, and the CVE has garnered no community discussion or media coverage, suggesting a low level of public awareness or active exploitation.