CVE-2014-0341

Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to objects.php; or the (5) email or (6) nickname field to pages.php, related to templates_internal/users.tpl.

• CWE-79

• http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
• http://pivotx.net/page/securityVendor Advisory
• http://sourceforge.net/p/pivot-weblog/code/4345/Exploit, Patch
• http://sourceforge.net/p/pivot-weblog/code/4349/Exploit, Patch
• http://www.kb.cert.org/vuls/id/901156US Government Resource
• http://www.securityfocus.com/bid/66800
• http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
• http://pivotx.net/page/securityVendor Advisory
• http://sourceforge.net/p/pivot-weblog/code/4345/Exploit, Patch
• http://sourceforge.net/p/pivot-weblog/code/4349/Exploit, Patch
• http://www.kb.cert.org/vuls/id/901156US Government Resource
• http://www.securityfocus.com/bid/66800

Published

Apr 15, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0334Multiple cross-site scripting (XSS) vulnerabilities in CMS M…
• CVE-2014-0335Multiple cross-site scripting (XSS) vulnerabilities in the w…
• CVE-2014-0336Cross-site request forgery (CSRF) vulnerability in the web c…
• CVE-2014-0337Cross-site scripting (XSS) vulnerability in the web interfac…
• CVE-2014-0338Multiple cross-site scripting (XSS) vulnerabilities in the f…
• CVE-2014-0339Cross-site scripting (XSS) vulnerability in view.cgi in Webm…
• CVE-2014-0342Multiple unrestricted file upload vulnerabilities in fileupl…
• CVE-2014-0343The web interface on Virtual Access GW6110A routers with sof…
• CVE-2014-0344Properties.do in ZOHO ManageEngine OpStor before build 8500 …
• CVE-2014-0346Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0347The Settings module in Websense Triton Unified Security Cent…
• CVE-2014-0348The Artiva Agency Single Sign-On (SSO) implementation in Art…