CVE-2017-16884

MEDIUM

mistserver < 2.13 - Unauthenticated Stored Cross-Site Scripting via Failed Authentication Alert

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-16884. PoCs published by hyp3rlinx.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated persistent XSS vulnerability in MistServer v2.12. Attackers can inject malicious payloads via failed HTTP authentication requests, which are then stored in server logs and executed in the web interface due to automatic UI refresh.

Description

Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to failed authentication requests alerts.

Exploits (1)

exploitdb WORKING POC VERIFIED
by hyp3rlinx · textwebappsmultiple
https://www.exploit-db.com/exploits/43205

This exploit demonstrates an unauthenticated persistent XSS vulnerability in MistServer v2.12. Attackers can inject malicious payloads via failed HTTP authentication requests, which are then stored in server logs and executed in the web interface due to automatic UI refresh.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: MistServer v2.12
No auth needed
Prerequisites: Network access to the target server · MistServer v2.12 with exposed admin interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/145182/MistServer-2.12-Cross-Site-Scripting.html
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2017/Dec/2
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43205/

Scores

CVSS v3 6.1
EPSS 0.0433
EPSS Percentile 89.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
mistserver/mistserver < 2.13
Published Dec 07, 2017
Tracked Since Feb 18, 2026