CVE-2014-2260

Eugene Pankov Ajenti 1.2.13 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.

References (5)

[Exploit] http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html

[Third Party Advisory, VDB Entry] http://www.osvdb.org/102174

[Exploit, Patch] https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310

[Issue Tracking] https://github.com/Eugeny/ajenti/issues/233

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/64982

Scores

EPSS 0.0022

EPSS Percentile 43.8%

Details

CWE

CWE-79

Status published

Products (3)

ajenti/ajenti

pypi/ajenti < 1.2.15PyPI

n/a/n/a

Published Apr 30, 2014

Tracked Since Feb 18, 2026