CVE-2017-14717

This CVE concerns EPESI 1.8.2 rev20170830 with a Stored XSS vulnerability in the Tasks Description field. The issue originates from user-controllable content stored in a task description, enabling script execution when viewed. Public references (e.g., Exploit-DB, 0day, and OpenVAS entries) corrob...

CVE-2017-14712

Affected product: EPESI 1.8.2 rev20170830. Vulnerability: Stored XSS in the Tasks Phonecall Notes Title parameter. Root cause (per sources): unescaped input in that field allows script injection, enabling arbitrary script execution in the context of the user. Impact: described as cross-site scrip...

CVE-2017-14715

CVE-2017-14715 affects EPESI 1.8.2 rev20170830 with a Stored XSS in the Tasks Alerts Title parameter. The CNVD entry confirms a cross-site scripting vulnerability exists and that an attacker can inject arbitrary web script or HTML. No additional technical details (e.g., exploit steps, affected ve...

CVE-2017-14713

Affected product: EPESI 1.8.2 rev20170830. Vulnerability: Stored XSS in the Phonecalls Description parameter. Root cause: input is stored and rendered in a way that allows injection of web script/HTML. Impact in CVSS indicates MEDIUM severity (CVSS-3.0 base 5.4) with user interaction required. No...

CVE-2017-14716

CVE-2017-14716 affects EPESI 1.8.2 rev20170830, where a Stored XSS exists in the Tasks Title parameter. The consolidated documents confirm the flaw is a stored cross-site scripting vulnerability in the Tasks Title field, with CVSS metrics indicating low severity for the base score (3.5) and a sin...

CVE-2017-14714

EPESI 1.8.2 rev20170830 is vulnerable to a stored cross-site scripting (XSS) flaw in the Phonecalls Subject field. The issue is documented across multiple sources (including CVE-2017-14714 entries and related advisories) as a stored XSS in the Phonecalls Subject parameter. The available connected...

CVE-2017-8763

CVE-2017-8763 affects Telaxus EPESI, specifically versions <= 1.8.2, where an XSS flaw exists in modules/Base/Box/check_for_new_version.php due to a crafted URI lacking the cid parameter. Reported impacts indicate remote injection of arbitrary script/HTML. OpenVAS notes EPESI