CVE-2014-1877

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-03-13 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone, (2) Street, (3) Address line, (4) Zip code, or (5) City field to main/auth/profile.php; (6) Subject field to main/social/groups.php; or (7) Message body field to main/messages/view_message.php.

Affected products

Dokeos Project Dokeos: 2.1.1

References

http://seclists.org/oss-sec/2014/q1/258
http://seclists.org/oss-sec/2014/q1/286
http://www.securityfocus.com/bid/65416
http://www.xchg.info/?p=381
https://exchange.xforce.ibmcloud.com/vulnerabilities/91295
http://seclists.org/oss-sec/2014/q1/258
http://seclists.org/oss-sec/2014/q1/286
http://www.securityfocus.com/bid/65416
http://www.xchg.info/?p=381
https://exchange.xforce.ibmcloud.com/vulnerabilities/91295

Get alerted when CVE-2014-1877 or the next vulnerability affects your stack