CVE-2014-9916

MEDIUM

Bilboplanet 2.0 - Cross-Site Scripting via Tribe Name or Tags Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-9916. PoCs published by Vivek N.

AI-analyzed exploit summary This is a writeup describing multiple stored XSS vulnerabilities in the Bilboplanet application version 2.0. It outlines three specific endpoints and parameters where XSS payloads can be injected, but does not include actual exploit code or payloads.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) tribe_name or (2) tags parameter in a tribes page request to user/ or the (3) user_id or (4) fullname parameter to signup.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Vivek N · textwebappsphp
https://www.exploit-db.com/exploits/34089

This is a writeup describing multiple stored XSS vulnerabilities in the Bilboplanet application version 2.0. It outlines three specific endpoints and parameters where XSS payloads can be injected, but does not include actual exploit code or payloads.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Bilboplanet 2.0
Auth required
Prerequisites: Access to the Bilboplanet application · Valid user credentials for authenticated endpoints
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/34089

Scores

CVSS v3 6.1
EPSS 0.0087
EPSS Percentile 54.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
bilboplanet/bilboplanet 2.0
Published Feb 24, 2017
Tracked Since Feb 18, 2026