# CVE-2014-3840: Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities

Source: https://junglewise.ai/threats/cve-2014-3840-mayan-edms-multiple-cross-site-scripting-xss-vulnerabilities  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2014-05-27  
License: CC BY 4.0 with a link back

CVE-2014-3840 · Severity: medium · CVSS 4 · Published 2014-05-27

Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.

Technologies: [mayan-edms (PyPI)](https://junglewise.ai/threats/technologies/mayan-edms). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2014-3840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-3840 being exploited in the wild.

**How severe is CVE-2014-3840?** Medium severity, with a CVSS score of 4, published 27 May 2014.

**Which products and versions are affected?** mayan-edms (PyPI) ECOSYSTEM:introduced=0, GIT:introduced=0,fixed=398c480c10416d76e7c1dcb607e726e8fc988e72|ECOSYSTEM:introduced=0.

**Is there a fix for CVE-2014-3840?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2014-3840?** Check whether you run mayan-edms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- mayan-edms (PyPI) ECOSYSTEM:introduced=0, GIT:introduced=0,fixed=398c480c10416d76e7c1dcb607e726e8fc988e72|ECOSYSTEM:introduced=0

## Identifiers

- CVE-2014-3840
- GHSA-wpvx-26f7-65q3
- PYSEC-2014-110

## Related threats

- [Mayan EDMS open redirect in authentication component](https://junglewise.ai/threats/cve-2025-14692-mayan-edms-open-redirect-in-authentication-component)
- [Mayan EDMS DOM-based XSS in authentication component](https://junglewise.ai/threats/cve-2025-14691-mayan-edms-dom-based-xss-in-authentication-component)
- [PYSEC-2023-276 - An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.](https://junglewise.ai/threats/cve-2022-47419-mayan-edms-dms-xss-vulnerability)
- [PYSEC-2018-16 - An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.](https://junglewise.ai/threats/cve-2018-16405-mayan-edms-cross-site-scripting-vulnerability)
- [PYSEC-2018-15 - An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.](https://junglewise.ai/threats/cve-2018-16407-moderate-severity-vulnerability-that-affects-mayan-edms)