CVE-2017-5990: An issue was discovered in PhreeBooksERP before 2017-02-13.

Security readout for executives and security teams

CVE-2017-5990 is a cross-site scripting issue in PhreeBooksERP before 2017-02-13. A crafted request could make a victim’s browser run attacker-controlled script within the vulnerable site. Business impact depends on whether those shipping label manager files are deployed and reachable. Exposure appears limited to PhreeBooksERP installations before 2017-02-13 that include the referenced UPS or YRC js_include.php files and expose them to users. Installations based only on the SourceForge stable R37RC1 release may not be affected, per the CVE note. Prioritize verification if PhreeBooksERP is internet-facing or used by authenticated business users. The issue can affect user trust and session integrity, but urgency is lower where the vulnerable files are absent or systems are already updated. Mitigation focus: Identify PhreeBooksERP deployments and confirm their source and update date.; Apply the upstream fix from 2017-02-13 or later where applicable.; Remove or restrict unreachable shipping label manager files if unused..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.