CVE-2014-0341

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
http://pivotx.net/page/securityVendor Advisory
http://sourceforge.net/p/pivot-weblog/code/4345/Exploit, Patch
http://sourceforge.net/p/pivot-weblog/code/4349/Exploit, Patch
http://www.kb.cert.org/vuls/id/901156US Government Resource
http://www.securityfocus.com/bid/66800
http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
http://pivotx.net/page/securityVendor Advisory
http://sourceforge.net/p/pivot-weblog/code/4345/Exploit, Patch
http://sourceforge.net/p/pivot-weblog/code/4349/Exploit, Patch
http://www.kb.cert.org/vuls/id/901156US Government Resource
http://www.securityfocus.com/bid/66800

Timeline

Published: Apr 15, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-03427.5Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbit CVE-2014-03434.9The web interface on Virtual Access GW6110A routers with software 9.00 before 9.09.27, 9.50 before 9.50.21, and 10.00 before 10.00.21 allows CVE-2014-03446.5Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated user CVE-2014-03473.5The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 CVE-2014-03483.5The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5 CVE-2014-034910.0Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.CVE-2014-03506.4The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers CVE-2014-03515.4The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonym CVE-2014-03536.1The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to bypass authentication by using %2F seq CVE-2014-03547.8The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 has a hardcoded password of qweasdzxc for an unspecified account,CVE-2014-03557.9Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allow man-in-the-middle CVE-2014-03567.9The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00(BFQ.6)C0 allows remote attackers to execute arbitrary code via shell metac