CVE-2014-2260: PYSEC-2014-98 - Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated

CVE-2014-2260 · Severity: low · CVSS 3.1 · Published 2014-04-30

Technologies: ajenti (PyPI). Vendors: PyPI.

Executive brief

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.

Affected products

PyPI ajenti

Related threats

PYSEC-2018-107 - ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.
PYSEC-2014-99 - Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allo