AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2017-12061

MEDIUM · CVSS 6.1 EPSS 2.94% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2017-08-01 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2017-12061
Severity
MEDIUM
CVSS
6.1
EPSS
2.94%
Java

Original NVD Description

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.