CVE-2014-4907
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in...
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
- Record
CVE-2014-4907- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
- Record
CVE-2014-4907- Updated
- 2026-11-02
EUVDEUVD-2014-4826 No score
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
- Record
EUVD-2014-4826- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4qq-4jc6-hr2v No score
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in...
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
- Record
GHSA-x4qq-4jc6-hr2v- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVMGASA-2015-0203 No score
Updated pnp4nagios packages fix security vulnerabilities
Updated pnp4nagios package fixes security vulnerabilities:
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message (CVE-2014-4907).
Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching share/pnp/application/views/kohana_error_page.php or share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element (CVE-2014-4908).
- Record
MGASA-2015-0203- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pnp4nagiosMageia:4 |
before 0.6.25-1.1.mga4 | 0.6.25-1.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4907 is a medium vulnerability (CVSS 4.3) in Pnp4nagios, published July 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in pnp4nagios 0.6.25-1.1.mga4.
References
secunia.com/advisories/59535
bugs.op5.com/view.php?id=8761
sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9
op5.com/blog/news/op5-monitor-6-3-1-release-notes
securityfocus.com/bid/68350
Show 7 moreShow less
openwall.com/lists/oss-security/2014/07/11/3
docs.pnp4nagios.org/pnp-0.6/dwnld
nvd.nist.gov/vuln/detail/CVE-2014-4907
github.com/advisories/GHSA-x4qq-4jc6-hr2v
advisories.mageia.org/MGASA-2015-0203.html
bugs.mageia.org/show_bug.cgi?id=13740
lists.fedoraproject.org/pipermail/package-announce/2014-July/135371.html