CVE-2014-4737 Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setup/index.php.
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setup/index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| textpattern | <= 4.5.5 | No fix listed |
| textpattern | = 4.5.0 | No fix listed |
| textpattern | = 4.5.1 | No fix listed |
| textpattern | = 4.5.2 | No fix listed |
| textpattern | = 4.5.3 | No fix listed |
| textpattern | = 4.5.4 | No fix listed |
References
- packetstormsecurity.com exploit
- textpattern.com exploit patch vendor-advisory
- 20141001 Reflected Cross-Site Scripting (XSS) in Textpattern mailing-list
- textpattern-cve20144737-xss(96802) vdb-entry
- www.htbridge.com exploit