Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-29170) - Vulnerability Database

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-29170)

Description

A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

References

CVE-2026-29170

Related Vulnerabilities

MySQL CVE-2022-21358 Vulnerability (CVE-2022-21358) Medium
Common tags: Missing Update Known Vulnerabilities
WordPress Improper Input Validation Vulnerability (CVE-2020-26596) High
Common tags: Missing Update Known Vulnerabilities
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-26120) Medium
Common tags: Missing Update Known Vulnerabilities
MediaWiki Incorrect Authorization Vulnerability (CVE-2020-26121) High
Common tags: Missing Update Known Vulnerabilities
silverstripeCMS Improper Authentication Vulnerability (CVE-2020-26136) Medium
Common tags: Missing Update Known Vulnerabilities

Severity

Medium

Classification

CVE-2026-29170
CWE-707
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update
Known Vulnerabilities