CVE-2014-3876
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex)...
CVE-2014-3876 is a medium vulnerability (CVSS 4.3) in Ulli Horlacher Fex, published June 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 80th percentile. Fixed in fex 20140530-1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.91%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
20140530-1fex +2 more
Description
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fexDebian:12 | before 20140530-1, plus listed versions 20110601-120110608-120110608-220110610-120110610-2 Show 24 moreShow less20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-1 | 20140530-1 |
fexDebian:13 | before 20140530-1, plus listed versions 20110601-120110608-120110608-220110610-120110610-2 Show 24 moreShow less20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-1 | 20140530-1 |
fexDebian:6.0 From an advisory covering 3 CVEs | before 20100208+debian1-1+squeeze4 | 20100208+debian1-1+squeeze4 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
- Record
CVE-2014-3876- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
- Record
CVE-2014-3876- Updated
- 2026-11-02
EUVDEUVD-2014-3813No score
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
- Record
EUVD-2014-3813- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cq7r-v3qw-j2jjNo score
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex)...
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
- Record
GHSA-cq7r-v3qw-j2jj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
- Record
CVE-2014-3876- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3876No score
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
- Record
DEBIAN-CVE-2014-3876- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html
fex.rus.uni-stuttgart.de/fex.html
lsexperts.de/advisories/lse-2014-05-22.txt
nvd.nist.gov/vuln/detail/CVE-2014-3876
github.com/advisories/GHSA-cq7r-v3qw-j2jj
security-tracker.debian.org/tracker/CVE-2014-3876