What’s added/changed in this version


The vulnerabilities are

Medium Risk: Reset password code check could be circumvented in member.php – reported by solati.sadegh
Medium Risk: Permissions not checked for post search with old sid in search.php – reported by pedder55655
Low Risk: CSRF in ACP mass mail cancellation – reported by Destroy666
Low Risk: Use of the U+200E Unicode character to create “duplicate” username – reported by mahdy2021
Low Risk: Multiple XSS vulnerability requiring admin permissions – reported by adamziaja, Devilshakerz, DingjieYang and sroesemann
Low Risk: A CSRF vulnerability within ACP login – reported by Devilshakerz
Low Risk: Cache handler using var_export without encoding checks – reported by chtg

Please view the 1.6.17 changes on the Docs site for more information about the changes in this version

Please note, that you do not need to run the upgrade script for this version