CVE-2017-17097

mediumpriority · attend · 51EPSS 0.069 · 94 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

6.95% (94th) EPSS

CVSS 5 · medium

Is it mine?

34 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9.8

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-640USprimary

exploits (1)

Public proof-of-concept and weaponised exploit code.

EDB-43431gps-server.net GPS Tracking Software < 3.1 - Multiple VulnerabilitiesPoC · exploit_db

affected products (34)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
gps-server gps tracking software= 2.1.1nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.2nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.3nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.4nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.5nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.6nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.7nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.8nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.1.9nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.2nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.2.1nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.2.2nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.2.5nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.2.7nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.3nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.3.2nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.3.5nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.4nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*
gps-server gps tracking software= 2.4.5nvdUScpe:2.3:a:gps-server:gps_tracking_software:*:*:*:*:*:*:*:*

showing 20 of 34

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2018-01-02modified 2026-06-17

related (366)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2023-7028US	critical9.8OT critical	94.5% (100th)	KEV	2024-01-12
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.…
CVE-2021-32648US	critical9.1OT critical	90.4% (100th)	KEV	2021-08-26
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain…
CVE-2019-18818US	critical9.8	97.6% (100th)	Exploit	2019-11-07
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
CVE-2017-7615US	high8.8	91.2% (100th)	Exploit	2017-04-16
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
CVE-2019-19844US	critical9.8	53.6% (99th)	Exploit	2019-12-18
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after cas…

+361 more

references (8)

External citations — patches, advisories, analysis.

https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec cnnvd
https://s1.gps-server.net/changelog.txt cnnvd
https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec enisa_euvd
https://s1.gps-server.net/changelog.txt enisa_euvd
https://www.exploit-db.com/exploits/43431/enisa_euvd
https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fecPatchThird Party Advisorynvd
https://s1.gps-server.net/changelog.txtRelease NotesVendor Advisorynvd
https://www.exploit-db.com/exploits/43431/ExploitThird Party AdvisoryVDB Entrynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan