CVE-2017-16962

6.1 mediumEPSS 2.2%

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2017-11-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

communigate:communigate_pro

References

https://packetstormsecurity.com/files/145095/communigatepro-xss.txt
https://www.exploit-db.com/exploits/43177/
https://packetstormsecurity.com/files/145095/communigatepro-xss.txt
https://www.exploit-db.com/exploits/43177/

Check your stack JSON