{"api_version":"1","generated_at":"2026-07-23T02:30:41+00:00","cve":"CVE-2014-2016","urls":{"html":"https://cve.report/CVE-2014-2016","api":"https://cve.report/api/cve/CVE-2014-2016.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-2016","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-2016"},"summary":{"title":"CVE-2014-2016","description":"Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-03-25 18:21:48","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/57438","name":"http://secunia.com/advisories/57438","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA57438 - OXID eShop Cross-Site Scripting and HTTP Header Injection Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://wiki.oxidforge.org/Security_bulletins/2014-001","name":"http://wiki.oxidforge.org/Security_bulletins/2014-001","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security bulletins/2014-001 - OXIDwiki","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2016","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2016","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"2016","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oxid-esales","cpe5":"eshop","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2016","vulnerable":"1","versionEndIncluding":"4.6.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oxid-esales","cpe5":"eshop","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:58:16.180Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://wiki.oxidforge.org/Security_bulletins/2014-001"},{"name":"57438","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/57438"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-03-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-03-25T13:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://wiki.oxidforge.org/Security_bulletins/2014-001"},{"name":"57438","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/57438"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-2016","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://wiki.oxidforge.org/Security_bulletins/2014-001","refsource":"CONFIRM","url":"http://wiki.oxidforge.org/Security_bulletins/2014-001"},{"name":"57438","refsource":"SECUNIA","url":"http://secunia.com/advisories/57438"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-2016","datePublished":"2014-03-25T14:00:00.000Z","dateReserved":"2014-02-17T00:00:00.000Z","dateUpdated":"2024-08-06T09:58:16.180Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-03-25 18:21:48","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*","versionEndIncluding":"4.6.8","matchCriteriaId":"60BF881E-E2F7-440D-9D0A-B35910737E50"},{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*","versionStartIncluding":"4.7.0","versionEndExcluding":"4.7.11","matchCriteriaId":"F7BA8D3A-2D28-4C88-9FF1-0EC1E85D0A38"},{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:community:*:*:*","versionStartIncluding":"4.8.0","versionEndExcluding":"4.8.4","matchCriteriaId":"FB4278C8-7513-453E-85D8-976585B21D17"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"4.6.8","matchCriteriaId":"2CDB8C9B-769C-4AFE-8976-0EAE8207DE32"},{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.11","matchCriteriaId":"7BAFCCBA-B925-46F1-AD6E-9FF5087A9149"},{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.4","matchCriteriaId":"97C77640-F154-4C88-A107-B265BB2F9005"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*","versionEndIncluding":"4.6.8","matchCriteriaId":"9D6FDE67-1E47-4DC9-8D3E-4B1C0EF655F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*","versionStartIncluding":"4.7.0","versionEndExcluding":"4.7.11","matchCriteriaId":"3390D62B-535C-4BEB-BC06-75B88BB50FC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:oxid-esales:eshop:*:*:*:*:professional:*:*:*","versionStartIncluding":"4.8.0","versionEndExcluding":"4.8.4","matchCriteriaId":"781923C0-2694-4C44-BD20-144196E180BF"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"2016","Ordinal":"1","Title":"CVE-2014-2016","CVE":"CVE-2014-2016","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"2016","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in OXID eShop Professional and Community Edition 4.6.8 and earlier, 4.7.x before 4.7.11, and 4.8.x before 4.8.4, and Enterprise Edition 4.6.8 and earlier, 5.0.x before 5.0.11 and 5.1.x before 5.1.4 allow remote attackers to inject arbitrary web script or HTML via the searchtag parameter to the getTag function in (1) application/controllers/details.php or (2) application/controllers/tag.php.","Type":"Description","Title":"CVE-2014-2016"},{"CveYear":"2014","CveId":"2016","Ordinal":"2","NoteData":"2014-03-25","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"2016","Ordinal":"3","NoteData":"2014-03-25","Type":"Other","Title":"Modified"}]}}}