CVE-2014-1403

🗓️ 05 Feb 2014 15:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

XSS vulnerability in easyXDM before 2.4.1

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2014-1403	5 Feb 201415:00	–	cvelist
EUVD	EUVD-2014-1480	7 Oct 202500:30	–	euvd
NVD	CVE-2014-1403	5 Feb 201415:10	–	nvd
Packet Storm	easyXDM Library Cross Site Scripting	2 Feb 201300:00	–	packetstorm
Prion	Cross site scripting	5 Feb 201415:10	–	prion

NVD

Node

easyxdm easyxdmRange≤2.4.18

OR

easyxdm easyxdmMatch2.3.2

OR

easyxdm easyxdmMatch2.3.3

OR

easyxdm easyxdmMatch2.4.0

OR

easyxdm easyxdmMatch2.4.1

OR

easyxdm easyxdmMatch2.4.2

OR

easyxdm easyxdmMatch2.4.3

OR

easyxdm easyxdmMatch2.4.4

OR

easyxdm easyxdmMatch2.4.5

OR

easyxdm easyxdmMatch2.4.6

Source	Link
seclists	www.seclists.org/fulldisclosure/2014/Feb/5
secunia	www.secunia.com/advisories/56634
osvdb	www.osvdb.org/102803
github	www.github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/90876
securityfocus	www.securityfocus.com/bid/65291
blog	www.blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html
github	www.github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13

Parameter	Position	Path	Description	CWE
location.hash	path	name.html	DOM XSS via location.hash leading to arbitrary script execution in name.html	CWE-79
location.hash	path	example/bridge.html	POC uses bridge.html flow where name.html is loaded with a malicious hash to trigger DOM XSS	CWE-79

17 Jun 2026 00:04Current

5.9Medium risk

Vulners AI Score5.9

CVSS 24.3

EPSS0.01804

cve-2014-1403 cross-site scripting xss easyxdm web security