CVE-2014-3786: Lucidcrew Pixie

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in the contact module (admin/modules/contact.php) in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the (1) uemail or (2) subject parameter in the Contact form to contact/.

Affected products

• Lucidcrew Pixie: version 1.04 only

Published 2014-06-04. Last modified 2026-06-17.