Search for vulnerabilities
| Vulnerability ID | VCID-1xx6-zucb-4ffq |
| Aliases |
CVE-2014-6393
GHSA-gpvr-g6gh-9mc2 |
| Summary | No Charset in Content-Type Header in express Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7. ## Recommendation For express 3.x, update express to version 3.11 or later. For express 4.x, update express to version 4.5 or later. |
| Status | Published |
| Exploitability | None |
| Weighted Severity | None |
| Risk | None |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| epss | 0.0029 | https://api.first.org/data/v1/epss?cve=CVE-2014-6393 |
| cvssv3.1 | 6.1 | https://bugzilla.redhat.com/show_bug.cgi?id=1203190 |
| generic_textual | MODERATE | https://bugzilla.redhat.com/show_bug.cgi?id=1203190 |
| cvssv3.1 | 6.1 | https://github.com/advisories/GHSA-gpvr-g6gh-9mc2 |
| cvssv3.1_qr | MODERATE | https://github.com/advisories/GHSA-gpvr-g6gh-9mc2 |
| generic_textual | MODERATE | https://github.com/advisories/GHSA-gpvr-g6gh-9mc2 |
| cvssv3 | 5.4 | https://github.com/nodejs/security-wg/blob/main/vuln/npm/8.json |
| cvssv3.1 | 6.1 | https://nvd.nist.gov/vuln/detail/CVE-2014-6393 |
| generic_textual | MODERATE | https://nvd.nist.gov/vuln/detail/CVE-2014-6393 |
| cvssv3.1 | 6.1 | https://www.npmjs.com/advisories/8 |
| generic_textual | MODERATE | https://www.npmjs.com/advisories/8 |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Percentile | 0.52643 |
| EPSS Score | 0.0029 |
| Published At | May 29, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-05-29T09:19:16.104668+00:00 | GithubOSV Importer | Import | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-gpvr-g6gh-9mc2/GHSA-gpvr-g6gh-9mc2.json | 38.6.0 |