CVE-2017-14922

CVE-2017-14922 describes a stored Cross-Site Scripting (XSS) vulnerability in Tine 2.0 Community Edition prior to version 2017.08.4. An authenticated user can inject malicious JavaScript through an IMG element in various profile sections (History, Calendar, Tasks, CRM), which then executes when viewed by other users, including administrators. Rated as MEDIUM severity (CVSS 5.4), this vulnerability requires user interaction (UI:R) and low privileges (PR:L) to exploit, but has a high scope change (S:C). Successful exploitation could lead to limited confidentiality and integrity impacts (C:L, I:L). There is no evidence of active exploitation, nor are there publicly available exploits in Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public awareness and attention.