CVEvulnerability
CVE-2014-9433
2.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-12-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in cms/front_content.php in Contenido before 4.9.6, when advanced mod rewrite (AMR) is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) idart, (2) lang, or (3) idcat parameter.
Affected configurations
• contenido contendio 4.9.0
• contenido contendio 4.9.1
• contenido contendio 4.9.2
• contenido contendio 4.9.3
• contenido contendio 4.9.4
• contenido contendio 4.9.5
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/129713/CMS-Contenido-4.9.5-Cross-Site-Scripting.html Exploit
- http://seclists.org/fulldisclosure/2014/Dec/111 Exploit
- http://secunia.com/advisories/61396 secunia.com
- http://sroesemann.blogspot.de/2014/12/report-for-advisory-sroeadv-2014-03.html Exploit
- http://www.contenido.org/de/cms/CONTENIDO/News/index-c-2044-3.html Vendor Advisory
- http://www.securityfocus.com/archive/1/534320/100/0/threaded www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99497 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.com/files/129713/CMS-Contenido-4.9.5-Cross-Site-Scripting.html Exploit
- http://seclists.org/fulldisclosure/2014/Dec/111 Exploit
- http://secunia.com/advisories/61396 secunia.com
- http://sroesemann.blogspot.de/2014/12/report-for-advisory-sroeadv-2014-03.html Exploit
- http://www.contenido.org/de/cms/CONTENIDO/News/index-c-2044-3.html Vendor Advisory
- http://www.securityfocus.com/archive/1/534320/100/0/threaded www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99497 exchange.xforce.ibmcloud.com