CVE-2014-9094

EPSS 7.3%

Vexday Risk Score

38Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 7.3%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

13 Jul 2014Public PoC

26 Nov 2014Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/39250unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://seclists.org/fulldisclosure/2014/Jul/65 http://websecurity.com.ua/7152/http://www.securityfocus.com/bid/108579 http://www.securityfocus.com/bid/68525