Unscored severity · published Sep 8, 2014
CVE-2014-5464
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or…
–
CVSS
4.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NT
Ntopng · Ntop
through 1.2.0; 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5464
secunia.com
http://secunia.com/advisories/60096
packetstormsecurity.com
http://packetstormsecurity.com/files/127995/ntopng-1.2.0-Cross-Site-Scripting.html
seclists.org
http://seclists.org/fulldisclosure/2014/Aug/65
seclists.org
http://seclists.org/fulldisclosure/2014/Sep/22
seclists.org
http://seclists.org/fulldisclosure/2014/Sep/28
www.exploit-db.com
http://www.exploit-db.com/exploits/34419
More from Ntopng
9.8
CVE-2026-38968
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking
8.8
CVE-2026-84990
ntopng: Missing Authorization on System Configuration Backup Download and Listing
8.8
CVE-2026-82412
ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
8.8
CVE-2017-5473
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by…
8.1
CVE-2026-83621
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs