{"api_version":"1","generated_at":"2026-07-23T10:47:35+00:00","cve":"CVE-2014-8365","urls":{"html":"https://cve.report/CVE-2014-8365","api":"https://cve.report/api/cve/CVE-2014-8365.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8365","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8365"},"summary":{"title":"CVE-2014-8365","description":"Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php, related to the \"PHP_SELF\" variable.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-10-20 18:55:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html","name":"http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Xornic Contact Us Form CAPTCHA Bypass / XSS ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2014/Jun/40","name":"http://seclists.org/fulldisclosure/2014/Jun/40","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: Xornic Contact Us Form - Captcha Bypass / XSS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8365","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8365","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8365","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xornic","cpe5":"contact_us","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:18:47.777Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html"},{"name":"20140608 Xornic Contact Us Form - Captcha Bypass / XSS","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Jun/40"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php, related to the \"PHP_SELF\" variable."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-10-20T18:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html"},{"name":"20140608 Xornic Contact Us Form - Captcha Bypass / XSS","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Jun/40"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-8365","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php, related to the \"PHP_SELF\" variable."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html"},{"name":"20140608 Xornic Contact Us Form - Captcha Bypass / XSS","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Jun/40"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-8365","datePublished":"2014-10-20T18:00:00.000Z","dateReserved":"2014-10-20T00:00:00.000Z","dateUpdated":"2024-09-16T20:42:59.894Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-20 18:55:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:xornic:contact_us:1.0:*:*:*:*:*:*:*","matchCriteriaId":"A06EA264-A026-4E35-B4AB-EDCC3DF007D1"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8365","Ordinal":"1","Title":"CVE-2014-8365","CVE":"CVE-2014-8365","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8365","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php, related to the \"PHP_SELF\" variable.","Type":"Description","Title":"CVE-2014-8365"},{"CveYear":"2014","CveId":"8365","Ordinal":"2","NoteData":"2014-10-20","Type":"Other","Title":"Published"}]}}}