CVE-2014-3875
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows...
CVE-2014-3875 is a medium vulnerability (CVSS 6.1) in Ulli Horlacher Fex, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 77th percentile. Fixed in fex 20140530-1.
- Severity
- 6.1 MediumCVSS 3.1, NVD
- Exploit chance
- 1.67%EPSS, 77th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
20140530-1fex +2 more
Description
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fexDebian:12 | before 20140530-1, plus listed versions 20110601-120110608-120110608-220110610-120110610-2 Show 24 moreShow less20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-1 | 20140530-1 |
fexDebian:13 | before 20140530-1, plus listed versions 20110601-120110608-120110608-220110610-120110610-2 Show 24 moreShow less20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-1 | 20140530-1 |
fexDebian:6.0 From an advisory covering 3 CVEs | before 20100208+debian1-1+squeeze4 | 20100208+debian1-1+squeeze4 |
What each source reports
NVD Score used
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
- Record
CVE-2014-3875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
- Record
CVE-2014-3875- Updated
- 2026-11-02
EUVDEUVD-2014-3812No score
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
- Record
EUVD-2014-3812- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rcxg-f2gm-5g8w
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows...
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
- Record
GHSA-rcxg-f2gm-5g8w- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
- Record
CVE-2014-3875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3875
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
- Record
DEBIAN-CVE-2014-3875- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html
security-tracker.debian.org/tracker/CVE-2014-3875
openwall.com/lists/oss-security/2014/06/03/6
seclists.org/fulldisclosure/2014/Jun/1
securityfocus.com/bid/67783
nvd.nist.gov/vuln/detail/CVE-2014-3875
github.com/advisories/GHSA-rcxg-f2gm-5g8w