CVE-2014-2860: Paperthin Commonspot Content Server

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a (1) ColdFusion or (2) JavaScript component.

Affected products

• Paperthin Commonspot Content Server: up to and including 7.0.1; version 8.0.0 only; version 8.0.1 only; version 8.0.2 only

Published 2014-04-15. Last modified 2026-06-17.