CVE-2014-3877: Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows...

Security readout for executives and security teams

CVE-2014-3877 is a cross-site scripting issue in Frams' Fast File EXchange, also called F*EX or fex. Versions before fex-20140530 did not fully block unsafe input in the fup addto parameter, allowing a remote attacker to make a user's browser run attacker-controlled script in the application context. Exposure is likely limited to organizations that deployed Frams' Fast File EXchange/F*EX/fex, especially internet-facing installations running versions before fex-20140530. The source bundle does not identify packaged distributions, hosted services, or downstream products. Handle as a targeted web-application remediation item, not an emergency internet-wide event. Prioritize quickly if F*EX is internet-facing or used by privileged staff, because XSS can support credential theft, session abuse, or trusted-user social engineering. Mitigation focus: Identify any F*EX/fex deployments and confirm their exact version.; Upgrade installations older than fex-20140530 following vendor guidance.; Restrict access to exposed F*EX upload interfaces until upgraded..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.