CVE-2014-8944

Name of the Vulnerable Software and Affected Versions: Lexiglot versions prior to 2014-11-20

Description: The issue allows for XSS (Reflected) via the username or XSS (Stored) via the "admin.php?page=config" endpoint, specifically through the install name, intro message, or new file content parameters.

Recommendations: For versions prior to 2014-11-20, as a temporary workaround, consider restricting access to the "admin.php?page=config" endpoint and avoid using the username, install name, intro message, or new file content parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.