Vulnerability record · CVE-2014-7264 · published 11 December 2014

CVE-2014-7264: Chyrp cross-site scripting vulnerability

Chyrp · Chyrp

Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.

3.5 CVSS 2.0 Low EPSS 1.4% · top 28.3% CWE-79 · Cross-site scripting

3.5CVSS 2.0 base score

1.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Chyrp Chyrp

References

Link	Tags
http://chyrp.net/2014/11/18/chyrp-251-security-release/	Vendor Advisory
http://jvn.jp/en/jp/JVN13160869/index.html	Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149	Vendor Advisory
https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb	Vendor Advisory
http://chyrp.net/2014/11/18/chyrp-251-security-release/	Vendor Advisory
http://jvn.jp/en/jp/JVN13160869/index.html	Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000149	Vendor Advisory
https://github.com/chyrp/chyrp/commit/43d1b6b266363ae7545d5d49851034eaeec7bebb	Vendor Advisory

Track CVE-2014-7264 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2025-69768Chyrp sql injection vulnerabilitySQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php componentEPSS 0.41%16 Mar 2026 6.8CVE-2011-2744Chyrp path traversal vulnerabilityDirectory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded …EPSS 9.0%19 Jul 2011 6.5CVE-2011-2745Chyrp permissions and access controls vulnerabilityupload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploa…EPSS 2.0%27 Jul 2011 6.1CVE-2012-1001Chyrp cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script…EPSS 3.6%21 Nov 2019 5.3CVE-2024-58285Chyrp cross-site scripting vulnerabilityChyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attack…EPSS 0.26%10 Dec 2025 5.0CVE-2011-2780Chyrp path traversal vulnerabilityDirectory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) …EPSS 13%19 Jul 2011 4.3CVE-2011-2743Chyrp cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the ac…EPSS 2.3%19 Jul 2011 6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed14 May 2026

Source: NIST National Vulnerability Database (record CVE-2014-7264), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.