CVE-2014-4857

Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the Created By field in a project activity.

• CWE-79

• http://forum.gurock.com/topic/1652/testrail-313-released/Vendor Advisory
• http://www.kb.cert.org/vuls/id/669804Third Party Advisory, US Government Resource
• http://forum.gurock.com/topic/1652/testrail-313-released/Vendor Advisory
• http://www.kb.cert.org/vuls/id/669804Third Party Advisory, US Government Resource

Published

Jul 26, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-4851Open redirect vulnerability in msg.php in FoeCMS allows remo…
• CVE-2014-4852SQL injection vulnerability in admin/uploads.php in The Digi…
• CVE-2014-4853Cross-site scripting (XSS) vulnerability in odm-init.php in …
• CVE-2014-4854Cross-site scripting (XSS) vulnerability in the WP Construct…
• CVE-2014-4855Cross-site scripting (XSS) vulnerability in the Polylang plu…
• CVE-2014-4856Cross-site scripting (XSS) vulnerability in the Polldaddy Po…
• CVE-2014-4858Multiple SQL injection vulnerabilities in CWPLogin.aspx in S…
• CVE-2014-4859Integer overflow in the Drive Execution Environment (DXE) ph…6.8
• CVE-2014-4860Multiple integer overflows in the Pre-EFI Initialization (PE…6.8
• CVE-2014-4861The Remote Desktop Launcher in Thycotic Secret Server before…
• CVE-2014-4862The Netmaster CBW700N cable modem with software 81.447.39211…
• CVE-2014-4863The Arris Touchstone DG950A cable modem with software 7.10.1…