CVE-2014-2260

Ajenti Cross-site scripting (XSS) vulnerability

3.5 LowFix available

CVE-2014-2260 is a low vulnerability (CVSS 3.5) in Ajenti, published April 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in ajenti 1.2.15.

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.

Exploit likelihood

1.50%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2014-2260
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-2260
Updated: 2026-11-02

EUVDEUVD-2014-0001 No score

Record: EUVD-2014-0001
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9crx-p357-5vw8 5.1

Ajenti Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Ajenti before 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.

Record: GHSA-9crx-p357-5vw8
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-9crx-p357-5vw8 5.1

Ajenti Cross-site scripting (XSS) vulnerability

Record: GHSA-9crx-p357-5vw8
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2014-98 No score

Record: PYSEC-2014-98
Updated: 2026-11-02

Affected products

ajenti

Affected packages

Affected packages
Package	Affected	Fixed
`ajenti` PyPI	before 1.2.15	1.2.15
`ajenti` PyPI	before 1.2.15, plus listed versions 0.99.110.99.190.99.200.99.210.99.22 Show 45 moreShow less 0.99.230.99.240.99.250.99.260.99.270.99.280.99.290.99.300.99.310.99.320.99.330.99.340.99.350.99.360.99.370.99.380.99.390.99.70.99.81.0.01.0.11.0.21.0.31.0.81.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.81.1.8.21.1.91.1.9.11.1.9.21.1.9.31.2.01.2.11.2.101.2.111.2.11.11.2.11.21.2.131.2.13.1	1.2.15
`ajenti` PyPI	before 1.2.14, plus listed versions 0.99.110.99.190.99.200.99.210.99.22 Show 45 moreShow less 0.99.230.99.240.99.250.99.260.99.270.99.280.99.290.99.300.99.310.99.320.99.330.99.340.99.350.99.360.99.370.99.380.99.390.99.70.99.81.0.01.0.11.0.21.0.31.0.81.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.81.1.8.21.1.91.1.9.11.1.9.21.1.9.31.2.01.2.11.2.101.2.111.2.11.11.2.11.21.2.131.2.13.1	1.2.14

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less

This page doesn't list everything

Left out here: 24 versions. The JSON record has them.