CVE-2014-4853: Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authent...

Security readout for executives and security teams

CVE-2014-4853 is an authenticated cross-site scripting issue in OpenDocMan before 1.2.7.3. A logged-in user could upload a file with a crafted filename that causes script or HTML to run when rendered by the application. Business risk depends on whether untrusted users can upload documents. Exposure is likely limited to OpenDocMan deployments older than 1.2.7.3 where authenticated users can upload files. Risk is higher when accounts are broadly issued to customers, contractors, or low-trust internal users. Treat this as a targeted remediation item, not an emergency from the available evidence. Prioritize faster if OpenDocMan is externally reachable or allows uploads by customers, partners, or many internal users. Mitigation focus: Upgrade OpenDocMan installations older than 1.2.7.3.; Review the vendor issue, commit, and release notes for exact remediation context.; Limit upload permissions to trusted users until upgraded..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.