CVE-2014-9017

Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp.

• CWE-79

• http://packetstormsecurity.com/files/130723/OpenKM-Stored-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Mar/48Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2015/Mar/51Mailing List, Third Party Advisory
• http://youtu.be/3jBQFAAq23kExploit, Third Party Advisory
• http://packetstormsecurity.com/files/130723/OpenKM-Stored-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Mar/48Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2015/Mar/51Mailing List, Third Party Advisory
• http://youtu.be/3jBQFAAq23kExploit, Third Party Advisory

Published

Mar 11, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9005Multiple SQL injection vulnerabilities in vldPersonals befor…
• CVE-2014-9006Monstra 3.0.1 and earlier uses a cookie to track how many lo…
• CVE-2014-9013The ajaxinit function in wpmarketplace/libs/cart.php in the …8.8
• CVE-2014-9014Directory traversal vulnerability in the ajaxinit function i…4.3
• CVE-2014-9015Drupal 6.x before 6.34 and 7.x before 7.34 allows remote att…
• CVE-2014-9016The password hashing API in Drupal 7.x before 7.34 and the S…
• CVE-2014-9018Icecast before 2.4.1 transmits the output of the on-connect …
• CVE-2014-9019Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-9020Cross-site scripting (XSS) vulnerability in the Quick Stats …
• CVE-2014-9021Multiple cross-site scripting (XSS) vulnerabilities in ZTE Z…
• CVE-2014-9022The Webform Component Roles module 6.x-1.x before 6.x-1.8 an…
• CVE-2014-9023The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not…