CVE-2014-2526

Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/.

• CWE-79

• http://barracudadrive.com/readme.txtRelease Notes, Vendor Advisory
• http://packetstormsecurity.com/files/125766Exploit, Third Party Advisory, VDB Entry
• http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txtBroken Link
• http://secpod.org/blog/?p=2158Broken Link
• http://secunia.com/advisories/57451Not Applicable, Third Party Advisory
• http://www.securityfocus.com/bid/66269Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91920VDB Entry, Vendor Advisory
• http://barracudadrive.com/readme.txtRelease Notes, Vendor Advisory
• http://packetstormsecurity.com/files/125766Exploit, Third Party Advisory, VDB Entry
• http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txtBroken Link
• http://secpod.org/blog/?p=2158Broken Link
• http://secunia.com/advisories/57451Not Applicable, Third Party Advisory
• http://www.securityfocus.com/bid/66269Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91920VDB Entry, Vendor Advisory

Published

Mar 25, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2520EMC Documentum Content Server before 6.7 SP2 P16 and 7.x bef…
• CVE-2014-2521EMC Documentum Content Server before 6.7 SP2 P16 and 7.x bef…
• CVE-2014-2522curl and libcurl 7.27.0 through 7.35.0, when running on Wind…
• CVE-2014-2523net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel …
• CVE-2014-2524The _rl_tropen function in util.c in GNU readline before 6.3…
• CVE-2014-2525Heap-based buffer overflow in the yaml_parser_scan_uri_escap…
• CVE-2014-2527kcleanup.cpp in KDirStat 2.7.0 does not properly quote strin…
• CVE-2014-2528kcleanup.cpp in KDirStat 2.7.3 does not properly quote strin…
• CVE-2014-2531SQL injection vulnerability in xhr.php in InterWorx Web Cont…
• CVE-2014-2532sshd in OpenSSH before 6.6 does not properly support wildcar…4.2
• CVE-2014-2533/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5…
• CVE-2014-2534/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5…