{"api_version":"1","generated_at":"2026-07-23T06:59:04+00:00","cve":"CVE-2014-9522","urls":{"html":"https://cve.report/CVE-2014-9522","api":"https://cve.report/api/cve/CVE-2014-9522.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-9522","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-9522"},"summary":{"title":"CVE-2014-9522","description":"Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML via the (1) author field to guestbook.php or (2) username field to account.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-01-05 20:59:18","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://osvdb.org/show/osvdb/115944","name":"http://osvdb.org/show/osvdb/115944","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/71676","name":"http://www.securityfocus.com/bid/71676","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Papoo Light Multiple HTML Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html","name":"http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"ITsec && other fun stuff: Bericht zu Advisory SROEADV-2014-01","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/35551","name":"http://www.exploit-db.com/exploits/35551","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html","name":"http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"CMS Papoo 6.0.0 Revision 4701 Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/534243/100/0/threaded","name":"http://www.securityfocus.com/archive/1/534243/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9522","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9522","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"9522","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"papoo","cpe5":"cms_papoo_light","cpe6":"6.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:47:41.263Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"115944","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/show/osvdb/115944"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html"},{"name":"20141215 Persistent XSS Vulnerability in CMS Papoo Light v6.0.0 Rev. 4701","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/534243/100/0/threaded"},{"name":"35551","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/35551"},{"name":"71676","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/71676"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-12-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML via the (1) author field to guestbook.php or (2) username field to account.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"115944","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/show/osvdb/115944"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html"},{"tags":["x_refsource_MISC"],"url":"http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html"},{"name":"20141215 Persistent XSS Vulnerability in CMS Papoo Light v6.0.0 Rev. 4701","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/534243/100/0/threaded"},{"name":"35551","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/35551"},{"name":"71676","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/71676"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-9522","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML via the (1) author field to guestbook.php or (2) username field to account.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"115944","refsource":"OSVDB","url":"http://osvdb.org/show/osvdb/115944"},{"name":"http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/129586/CMS-Papoo-6.0.0-Revision-4701-Cross-Site-Scripting.html"},{"name":"http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html","refsource":"MISC","url":"http://sroesemann.blogspot.de/2014/12/bericht-zu-advisory-sroeadv-2014-01.html"},{"name":"20141215 Persistent XSS Vulnerability in CMS Papoo Light v6.0.0 Rev. 4701","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/534243/100/0/threaded"},{"name":"35551","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/35551"},{"name":"71676","refsource":"BID","url":"http://www.securityfocus.com/bid/71676"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-9522","datePublished":"2015-01-05T20:00:00.000Z","dateReserved":"2015-01-05T00:00:00.000Z","dateUpdated":"2024-08-06T13:47:41.263Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-05 20:59:18","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:papoo:cms_papoo_light:6.0.0:*:*:*:*:*:*:*","matchCriteriaId":"3B63AF1E-E4BB-4278-A4EA-B9769271BDB3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"9522","Ordinal":"1","Title":"CVE-2014-9522","CVE":"CVE-2014-9522","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"9522","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML via the (1) author field to guestbook.php or (2) username field to account.php.","Type":"Description","Title":"CVE-2014-9522"},{"CveYear":"2014","CveId":"9522","Ordinal":"2","NoteData":"2015-01-05","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"9522","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}