$ cve CVE-2017-14096 JSON

CVE-2017-14096 EXPLOIT

6.1

MEDIUM · CVSS 3.0 · EPSS 3% (pctl 87)

Patch early

A public exploit exists.

Description

A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to execute a malicious payload on vulnerable systems.

Scoring

CVSS	6.1 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS	3.04% — more likely to be exploited than 87% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2018-01-19
Last modified	2026-06-17

Affected (1)

Vendor	Product
trendmicro	smart protection server

Public exploits

Source	Title	Date
exploit-db	Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control	2017-12-19

References

http://www.securityfocus.com/bid/102275
https://success.trendmicro.com/solution/1118992
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
https://www.exploit-db.com/exploits/43388/
http://www.securityfocus.com/bid/102275
https://success.trendmicro.com/solution/1118992
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
https://www.exploit-db.com/exploits/43388/

→ the Explorer · watch your stack · NVD