Unscored severity · published Dec 11, 2014
CVE-2014-7264
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chyrp · Chyrp
through 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7264
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7264
Vendor Advisory
http://chyrp.net/2014/11/18/chyrp-251-security-release/
Vendor Advisory
http://jvn.jp/en/jp/JVN13160869/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149
Vendor Advisory
https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb
More from Chyrp
7.5
CVE-2025-69768
SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component
6.1
CVE-2012-1001
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content…
5.4
CVE-2024-58285
Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title
–
CVE-2011-2745
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote…
–
CVE-2011-2780
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a