Unscored severity · published Apr 30, 2014
CVE-2014-2260
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AJ
Ajenti · Ajenti
1.2.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2260
Exploit
http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html
www.osvdb.org
http://www.osvdb.org/102174
www.securityfocus.com
http://www.securityfocus.com/bid/64982
Exploit
https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310
github.com
https://github.com/Eugeny/ajenti/issues/233
More from Ajenti
9.9
CVE-2026-79920
Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
9.8
CVE-2026-27975
Ajenti has a potential Remote Code Execution
8.8
CVE-2019-25066
ajenti API privileges management
8.8
CVE-2018-1000082
Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server
7.5
CVE-2026-40177
Password bypass when 2FA is activated