CVE-2014-9714
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka...
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
- Record
CVE-2014-9714- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
- Record
CVE-2014-9714- Updated
- 2026-11-02
EUVDEUVD-2014-9521 No score
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
- Record
EUVD-2014-9521- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-48q6-73v9-grfj No score
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka...
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
- Record
GHSA-48q6-73v9-grfj- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9714 is a medium vulnerability (CVSS 4.3) in Facebook Hiphop Virtual Machine, published April 13, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. No source names a fixed version.
References
securityfocus.com/bid/74061
phabricator.wikimedia.org/T85851
github.com/facebook/hhvm/commit/324701c9fd31beb4f070f1b7ef78b115fbdfec34
openwall.com/lists/oss-security/2015/04/07/3
lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
nvd.nist.gov/vuln/detail/CVE-2014-9714