CVE-2017-16896: A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the

This month

CRITICAL 9.8REMOTEDOWNGRADE

CVE-2017-16896 is a critical-severity flaw (CVSS 9.8) affecting tiny tiny rss. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.

Why this priority

Critical severity
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.5% (top 26%)
CISA exploited list	No
Weakness	CWE-89
Published	2017-11-20
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: tt-rss

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-11-20 16:29 UTCPublished CVE record published
2026-06-17 01:10 UTCUpdated Record last modified

tt-rss tiny tiny rss DOWNGRADE

Affected: 17.4

Fixed in: no fixed release known

Safe to downgrade to: a release before 17.4

1. Check installed version

apt-cache policy tiny-tiny-rss || rpm -q tiny-tiny-rss || tiny-tiny-rss --version

2. No fixed release: DOWNGRADE to a release before 17.4 (Debian / Ubuntu)

apt-cache madison tiny-tiny-rss sudo apt install tiny-tiny-rss=<VERSION_BEFORE_17.4> sudo apt-mark hold tiny-tiny-rss

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tiny-tiny-rss sudo dnf downgrade tiny-tiny-rss-<VERSION_BEFORE_17.4> sudo dnf versionlock add tiny-tiny-rss

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-16896?

tiny tiny rss: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2017-16896 being exploited?

CVE-2017-16896 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-16896 affect?

CVE-2017-16896 affects tiny tiny rss. Severity is critical (CVSS 9.8). A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.

How urgent is CVE-2017-16896?

Priority 58/100. Critical severity; Remotely exploitable, no login, no user action

Software pages

PHP vulnerabilities

Related CVEs

CVE-2021-28373 HIGH 7.5 UPGRADE The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the
CVE-2020-25789 MEDIUM 6.1 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
CVE-2020-25788 HIGH 8.1 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
CVE-2020-25787 CRITICAL 9.8 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
CVE-2017-1000035 MEDIUM 6.1 MITIGATE Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack

References

← Back to latest CVEs