{"action":"Upgrade fex to 20140530-1 or later.","affected":[{"fixed":"20140530-1","introduced":"0"}],"component":"fex","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["20140530-1"],"id":"tcs_01M5NATC6WNWY60YGEAVHF2CED","modified_at":"2026-10-23T15:47:23.043035954Z","published_at":"2014-06-18T14:55:12.960Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2014-3877","https://security-tracker.debian.org/tracker/CVE-2014-3877"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2014-3877","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2014-3877"}],"summary":"Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup"}