CVE-2014-7261: Cross-site scripting (XSS) vulnerability in ULTRAPOP.JP i-HTTPD allows remote attackers to inject arbitrary...

Security readout for executives and security teams

This is an older cross-site scripting issue in ULTRAPOP.JP i-HTTPD. If an affected server builds a directory index page from attacker-controlled input, a visitor could receive injected script or HTML. The provided sources do not include severity, affected versions, or confirmed active exploitation. Exposure is likely limited to environments still running ULTRAPOP.JP i-HTTPD, especially where directory index pages are reachable. The source bundle does not identify affected versions, CPEs, or deployment prevalence. Prioritize asset discovery first. This should not drive emergency action unless ULTRAPOP.JP i-HTTPD is present and exposed, but unsupported or internet-facing legacy web services should be reduced quickly. Mitigation focus: Inventory assets for ULTRAPOP.JP i-HTTPD exposure.; Check JVN, JVNDB, and vendor guidance for affected versions and fixes.; Disable or restrict directory indexing where business permits..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.