Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in…
Priority LOW 20CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
Why it matters now
EPSS 0.01493 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed ajenti (PyPI): 1.2.15
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | ajenti (PyPI) | before 1.2.15 | 1.2.15 | Patch available | GHSA-9crx-p357-5vw8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- ajenti (PyPI) Vendor— Affected before 1.2.15 Fixed in 1.2.15 Patch available GHSA-9crx-p357-5vw8
Remediation
- Fix · GHSA-9crx-p357-5vw8 ajenti (PyPI) Fixed in 1.2.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2014-2260
- 2026-10-03 Alias added: GHSA-9crx-p357-5vw8
References
Exploit 2
Other 7
- 102174
- https://github.com/Eugeny/ajenti/issues/233
- https://github.com/ajenti/ajenti/issues/233
- https://github.com/ajenti/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310
- https://github.com/ajenti/ajenti
- https://github.com/pypa/advisory-database/tree/main/vulns/ajenti/PYSEC-2014-98.yaml
- https://web.archive.org/web/20200229062920/http://www.securityfocus.com/bid/64982
More Ajenti vulnerabilities
- TI-2019-15206 ajenti API privileges management CVSS 3.1HIGH 8.8
- TI-2026-22317 Ajenti has a potential Remote Code Execution CVSS 4.0HIGH 8.1
- TI-2018-15737 Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the… CVSS 3.0HIGH 8.8
- TI-2018-15779 Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code… CVSS 3.0HIGH 7.5
- TI-2018-15736 Ajenti version version 2 contains a Input Validation vulnerability in ID string on… CVSS 3.0HIGH 7.5
- TI-2026-27329 Ajenti has an authorization bypass during custom package installation CVSS 4.0HIGH 7.2
Sources
- CVE-2014-2260 · CVE Program
- CVE-2014-2260 · NVD
- FIRST EPSS
- GHSA-9crx-p357-5vw8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences