$ cve CVE-2014-4312 JSON

CVE-2014-4312 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 4.2% (pctl 91)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Description section to "Order to consume"; (3) Favorites name section to Favorites; (4) FiltKeyword parameter to Procurement/EKPHTML/search_item_bt.asp; (5) Act parameter to Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp; (6) hdnOpener or (7) hdnApproverFieldName parameter to Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp; or (8) INTEGRATED parameter to Procurement/EKPHTML/EnterpriseManager/Codes.asp.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	4.18% — more likely to be exploited than 91% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2014-10-10
Last modified	2026-06-17

Affected (1)

Vendor	Product
epicor	epicor enterprise

Public exploits

Source	Title	Date
exploit-db	Epicor Enterprise 7.4 - Multiple Vulnerabilities	2014-10-02

References

→ the Explorer · watch your stack · NVD