CVE-2014-3875

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-27 · updated 2026-06-17
Weakness: CWE-79

Description

The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks

Affected products

Ulli Horlacher Fex: before 2014053 — fixed in 2014053

How to fix

Upgrade to a fixed version: Ulli Horlacher Fex 2014053. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2014/Jun/1
http://www.openwall.com/lists/oss-security/2014/06/03/6
http://www.securityfocus.com/bid/67783
https://security-tracker.debian.org/tracker/CVE-2014-3875
http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2014/Jun/1
http://www.openwall.com/lists/oss-security/2014/06/03/6
http://www.securityfocus.com/bid/67783
https://security-tracker.debian.org/tracker/CVE-2014-3875

Get alerted when CVE-2014-3875 or the next vulnerability affects your stack