Cross-Site Scripting Vulnerability in Textpattern CMS by Textpattern
CVE-2014-4737

Currently unrated

Key Information:

Vendor: Textpattern
Status: Textpattern
Vendor: CVE Published:; 10 October 2014

🔔 Create Textpattern Vulnerability Alert

What is CVE-2014-4737?

A cross-site scripting (XSS) vulnerability exists in Textpattern CMS prior to version 4.5.7. This flaw allows remote attackers to craft malicious web scripts or HTML that can be injected via the PATH_INFO parameter in the setup/index.php file. If exploited, this vulnerability can compromise the security of the CMS, potentially allowing an attacker to execute unauthorized actions or access sensitive information. Users are encouraged to update to the latest version of Textpattern CMS to mitigate this risk.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/96802

vdb-entryx_refsource_XF

http://packetstormsecurity.com/files/128519/Textpattern-4...

x_refsource_MISC

http://textpattern.com/weblog/379/textpattern-cms-457-rel...

x_refsource_MISC

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 10, 2014
Vulnerability Reserved
Jul 8, 2014

CVE-2014-4737 Data

JSON