CVE-2014-6027

Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.4 allow (1) remote attackers to inject arbitrary web script or HTML by leveraging failure to encode file contents when downloading a torrent file or (2) remote authenticated users to inject arbitrary web script or HTML via vectors involving a link to torrent details.

• CWE-79

• http://www.openwall.com/lists/oss-security/2014/09/02/3Issue Tracking, Mailing List, Third Party Advisory
• http://www.securitytracker.com/id/1030791Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759574Exploit, Issue Tracking, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/09/02/3Issue Tracking, Mailing List, Third Party Advisory
• http://www.securitytracker.com/id/1030791Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759574Exploit, Issue Tracking, Third Party Advisory

Published

Jan 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-6020The Fuel Rewards Network (aka com.excentus.frn) application …
• CVE-2014-6021The Harley-Davidson Visa (aka com.usbank.icsmobile.harleydav…
• CVE-2014-6022The Versent Books (aka com.versentbooks) application 1.1.99 …
• CVE-2014-6023The s-peek credit rating report (aka com.rhomobile.speek) ap…
• CVE-2014-6024The Flurry library before 3.4.0 for Android does not verify …
• CVE-2014-6025The Chartboost library before 2.0.2 for Android does not ver…
• CVE-2014-6028TorrentFlux 2.4 allows remote authenticated users to obtain …
• CVE-2014-6029TorrentFlux 2.4 allows remote authenticated users to delete …
• CVE-2014-6030Multiple SQL injection vulnerabilities in ClassApps SelectSu…
• CVE-2014-6031Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x…
• CVE-2014-6032Multiple XML External Entity (XXE) vulnerabilities in the Co…
• CVE-2014-6033Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…