CVE-2014-2890

MEDIUM 4.3CVE-2014-2890 · Published 22/04/2014 · updated 17/06/2026

In short

CVE-2014-2890 is a MEDIUM (CVSS 4.3) vulnerability affecting phpmyid (siege).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
phpmyid siege	`= 0.9`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_error parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error message.

References

seclists.org/oss-sec/2014/q2/122 · Exploit
seclists.org/oss-sec/2014/q2/141 · Exploit
securityfocus.com/bid/66665 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free