CVE-2014-8690

🗓️ 19 Feb 2015 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

Multiple XSS vulnerabilities in Exponent CMS before certain patches allow remote script injection

Reporter	Title	Published	Views	Family All 9
0day.today	Exponent CMS 2.3.1 - Multiple XSS Vulnerabilities	14 Feb 201500:00	–	zdt
CNVD	Multiple Cross-Site Scripting Vulnerabilities in Exponent CMS	21 Feb 201500:00	–	cnvd
Cvelist	CVE-2014-8690	19 Feb 201515:00	–	cvelist
Exploit DB	Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities	12 Feb 201500:00	–	exploitdb
exploitpack	Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities	12 Feb 201500:00	–	exploitpack
NVD	CVE-2014-8690	19 Feb 201515:59	–	nvd
OpenVAS	Exponent CMS < 2.3.1 Patch 4 Multiple XSS Vulnerabilities	16 Feb 201500:00	–	openvas
Packet Storm	Exponent CMS 2.3.1 Cross Site Scripting	12 Feb 201500:00	–	packetstorm
Prion	Cross site scripting	19 Feb 201515:59	–	prion

NVD

Node

exponentcms exponent_cmsRange≤2.1.4

exponentcms exponent_cmsMatch2.2.0

exponentcms exponent_cmsMatch2.2.1

exponentcms exponent_cmsMatch2.2.2

exponentcms exponent_cmsMatch2.2.3

exponentcms exponent_cmsMatch2.3.0

exponentcms exponent_cmsMatch2.3.1

Source	Link
osvdb	www.osvdb.org/show/osvdb/118263
exploit-db	www.exploit-db.com/exploits/36059
exponentcms	www.exponentcms.lighthouseapp.com/projects/61783/tickets/1230-universal-cross-site-scripting-in-exponent-cms-231-and-prior
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/100877
packetstormsecurity	www.packetstormsecurity.com/files/130382/Exponent-CMS-2.3.1-Cross-Site-Scripting.html
osvdb	www.osvdb.org/show/osvdb/118345
exponentcms	www.exponentcms.org/news/show/title/corrected-security-patches-released-for-v2-1-4-v2-2-3-and-v2-3-0
securitytracker	www.securitytracker.com/id/1031775

Parameter	Position	Path	Description	CWE
PATH_INFO	path	/news/show/title/time-for-a-heavy-harvest-new-release/src/%22%3E%3Cscript%3Ealert%287%29%3C/script%3E@random4cd201e063d5c	Universal XSS via unsanitized path info leading to script execution.	CWE-79
src	path	/news/show/title/time-for-a-heavy-harvest-new-release/src/%22%3E%3Cscript%3Ealert%287%29%3C/script%3E@random4cd201e063d5c	Universal XSS via unsanitized path info leading to script execution.	CWE-79
PATH_INFO	path	/news/show/title/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Etime-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c	Universal XSS via path containing payload in URL to trigger script execution.	CWE-79
src	path	/news/show/title/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Etime-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c	Universal XSS via path containing payload in URL to trigger script execution.	CWE-79
PATH_INFO	path	/news/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Eshow/title/time-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c	Universal XSS via crafted URL segments propagating script payload.	CWE-79
src	path	/news/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Eshow/title/time-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c	Universal XSS via crafted URL segments propagating script payload.	CWE-79
First Name	request body	/exponent/users/edituser	XSS in user profile fields (First Name/Last Name) enabling script injection.	CWE-79
Last Name	request body	/exponent/users/edituser	XSS in user profile fields (First Name/Last Name) enabling script injection.	CWE-79

17 Jun 2026 00:17Current

5.7Medium risk

Vulners AI Score5.7

CVSS 24.3

EPSS0.03954

CWE-79