Webpagetest Project maintains a performance-testing and website-analysis tool that is widely used by developers and performance engineers to assess web application behavior, despite its narrow product scope. The vendor's recurring vulnerability signal centers on cross-site scripting weaknesses in its web interface, reflecting the challenge of safely rendering and processing user-supplied test parameters and result data in a browser-accessible application. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webpagetest Project over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-17199HIGH www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.j | Oct 5, 2019 | 7.5 | 40 | NO | YES |
CVE-2019-12161HIGH WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168). | May 17, 2019 | 8.8 | 28 | NO | NO |
CVE-2017-6541MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, time) pass | Mar 8, 2017 | 6.1 | 22 | NO | NO |
CVE-2017-6536MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (url, pssid) passed to | Mar 8, 2017 | 6.1 | 22 | NO | NO |
CVE-2017-6540MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (configs) passed to th | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6539MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, time) pass | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6538MEDIUM A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (video) passed to the webpagetes | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6537MEDIUM A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (bgcolor) passed to the webpaget | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6535MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, url) passe | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6534MEDIUM A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (pssid) passed to the webpagetes | Mar 8, 2017 | 6.1 | 17 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webpagetest Project.
Media articles that mention a CVE ID that affects a product developed by Webpagetest Project — matched by CVE ID, not by vendor name.