CVE-2014-2260
Ajenti < 1.2.15 - Authenticated Stored Cross-Site Scripting via Cron Command Field
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/64982
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/102174
Exploit x_refsource_misc
http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html
Issue Tracking x_refsource_confirm
https://github.com/Eugeny/ajenti/issues/233
Exploit, Patch x_refsource_misc
https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310
Scores
EPSS
0.0149
EPSS Percentile
71.3%
Details
CWE
CWE-79
Status
published
Products (2)
ajenti/ajenti
1.2.13
pypi/ajenti
0 - 1.2.15PyPI
Published
Apr 30, 2014
Tracked Since
Feb 18, 2026