CVE-2017-11202: FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted...

Security readout for executives and security teams

FineCMS versions through 2017-07-12 can store unsafe JavaScript from visited URLs and later display it in visitor logs. If a staff member views those logs, their browser could execute attacker-controlled script. The sources do not provide a CVSS score, confirmed patch, or active exploitation evidence. Exposure is most likely where FineCMS versions through 2017-07-12 are still deployed and visitor logs are available to administrators or content managers. Internet-facing sites are more exposed because external visitors can influence logged URL data. Treat this as a legacy web application risk. It is not confirmed as actively exploited in the provided sources, but stored XSS in administrative logs can affect privileged users. Prioritize if FineCMS remains internet-facing or unsupported. Mitigation focus: Inventory any FineCMS deployments and determine whether they are through 2017-07-12.; Check FineCMS vendor or project guidance for fixed versions or official remediation.; Restrict access to visitor log pages to trusted administrative users only..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.