CVE-2014-3840: Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in M...

Security readout for executives and security teams

Mayan EDMS 0.13 lets an authenticated user store malicious script or HTML in several title, name, and tag fields. When another user views affected UI, their browser may run it. In a document management system, this can expose sessions or sensitive data, but sources do not show unauthenticated exploitation or confirmed active attacks. Exposure is likely limited to Mayan EDMS 0.13 deployments where authenticated users can create or edit the affected objects. Internet-facing or multi-tenant document portals have higher business risk because attacker-controlled content may reach privileged users. Treat as a targeted cleanup item, not an emergency unless Mayan EDMS 0.13 is exposed to untrusted users. Prioritize because document systems often contain sensitive data and stored XSS can affect higher-privilege viewers. Mitigation focus: Identify any Mayan EDMS 0.13 instances, including internal document portals.; Review and apply upstream Mayan EDMS vendor fixes or upgrade guidance.; Prioritize internet-facing and shared-user deployments first..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.