Unrated severityNVD Advisory· Published Mar 11, 2015· Updated Jun 17, 2026

CVE-2014-9017

Description

Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 (build 23338) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Openkm/Openkm2 versions
cpe:2.3:a:openkm:openkm:*:*:*:*:professional:*:*:*+ 1 more
- cpe:2.3:a:openkm:openkm:*:*:*:*:professional:*:*:*range: <=6.4.18
- (no CPE)range: <6.4.19 (build 23338)

Patches

Vulnerability mechanics

References

youtu.be/3jBQFAAq23knvdExploitThird Party Advisory
packetstormsecurity.com/files/130723/OpenKM-Stored-Cross-Site-Scripting.htmlnvdThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2015/Mar/48nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2015/Mar/51nvdMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000