CVE-2017-11202

MEDIUM

Finecms - XSS

Title source: rule

Description

FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180.

References (1)

[Exploit, Third Party Advisory] http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Stored-XSS-in-visitors-php

Scores

CVSS v3 6.1

EPSS 0.0024

EPSS Percentile 47.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

finecms_project/finecms

n/a/n/a

Published Jul 13, 2017

Tracked Since Feb 18, 2026