{"id":"CVE-2014-8690","aliases":["EUVD-2014-8522","GHSA-6p6p-79v7-c2jj"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x...","description":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) \"First Name\" or (4) \"Last Name\" field to users/edituser.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03954,"percentile":0.90503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2015-02-19T15:00:00Z","modified":"2026-06-17T00:17:11Z","exploits":[{"source":"exploitdb","id":"EDB-36059","title":"Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"php","date":"2015-02-12","url":"https://www.exploit-db.com/exploits/36059"}],"products":[{"vendor":"exponentcms","product":"exponent_cms"}],"references":[{"url":"http://packetstormsecurity.com/files/130382/Exponent-CMS-2.3.1-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.securitytracker.com/id/1031775","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://osvdb.org/show/osvdb/118263","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://osvdb.org/show/osvdb/118345","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.exponentcms.org/news/show/title/corrected-security-patches-released-for-v2-1-4-v2-2-3-and-v2-3-0","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/36059","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://exponentcms.lighthouseapp.com/projects/61783/tickets/1230-universal-cross-site-scripting-in-exponent-cms-231-and-prior","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100877","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8690"},{"url":"https://github.com/advisories/GHSA-6p6p-79v7-c2jj"}],"sources":{"cve":[{"id":"CVE-2014-8690","description":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) \"First Name\" or (4) \"Last Name\" field to users/edituser.","status":"published","published":"2015-02-19T15:00:00Z","modified":"2024-08-06T13:26:02.335Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-8522","description":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) \"First Name\" or (4) \"Last Name\" field to users/edituser.","status":"published","published":"2015-02-19T15:00:00Z","modified":"2024-08-06T13:26:02Z","updated_at":"2026-11-03T01:56:51.030673Z"}],"ghsa":[{"id":"GHSA-6p6p-79v7-c2jj","title":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x...","description":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) \"First Name\" or (4) \"Last Name\" field to users/edituser.","status":"published","published":"2022-05-17T01:12:57Z","modified":"2023-02-03T05:03:23Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:53:20.596522Z"}],"nvd":[{"id":"CVE-2014-8690","description":"Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) \"First Name\" or (4) \"Last Name\" field to users/edituser.","status":"published","published":"2015-02-19T15:59:06.58Z","modified":"2026-06-17T00:17:11.417Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:58.385843Z"}]}}