CVE-2014-100004

NUCLEI

Sitecore Cms < 7.0 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.

Nuclei Templates (1)

Sitecore CMS - Cross-Site Scripting
MEDIUMVERIFIEDby DhiyaneshDK
Shodan: html:"Sitecore"

References (6)

Scores

EPSS 0.0033
EPSS Percentile 55.9%

Details

CWE
CWE-79
Status published
Products (1)
sitecore/cms < 7.0
Published Jan 13, 2015
Tracked Since Feb 18, 2026