CVE-2017-0912

Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with "Edit" access to "Scheduling".

• CWE-79

• https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814Vendor Advisory
• https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814Vendor Advisory

Published

Jul 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-0906The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.…
• CVE-2017-0907The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8,…
• CVE-2017-0908Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-0909The private_address_check ruby gem before 0.4.1 is vulnerabl…
• CVE-2017-0910In Zulip Server before 1.7.1, on a server with multiple real…
• CVE-2017-0911Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a…
• CVE-2017-0913Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated…
• CVE-2017-0914Gitlab Community and Enterprise Editions version 10.1, 10.2,…
• CVE-2017-0915Gitlab Community Edition version 10.2.4 is vulnerable to a l…
• CVE-2017-0916Gitlab Community Edition version 10.3 is vulnerable to a lac…
• CVE-2017-0917Gitlab Community Edition version 10.2.4 is vulnerable to lac…
• CVE-2017-0918Gitlab Community Edition version 10.3 is vulnerable to a pat…