III maintains a modestly represented portfolio centered on library and discovery systems, including products such as Sierra, Encore Discovery Solution, and VTLS Virtua that support academic and institutional information management. The recurring vulnerability signal reflects common application-layer weaknesses in web-facing library platforms: information disclosure, cross-site scripting, and SQL injection, alongside instances where vulnerability taxonomy could not be precisely determined. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Iii over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-2081HIGH Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before 2013.2.4 and 2014.x before 2014.1.1 allow remote attacke | Oct 20, 2014 | 7.5 | 35 | NO | YES |
CVE-2014-5138HIGH Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to | Jan 14, 2020 | 7.5 | 24 | NO | NO |
CVE-2014-5127MEDIUM Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via | Aug 29, 2014 | 5.8 | 20 | NO | NO |
CVE-2014-5137MEDIUM Innovative Interfaces Sierra Library Services Platform 1.2_3 provides different responses for login request depending on whether the user account exists, which allows remote attack | Sep 2, 2014 | 5.0 | 19 | NO | NO |
CVE-2014-5128MEDIUM Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors. | Aug 29, 2014 | 5.0 | 19 | NO | NO |
CVE-2014-5136MEDIUM Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecif | Sep 2, 2014 | 4.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Iii.
Media articles that mention a CVE ID that affects a product developed by Iii — matched by CVE ID, not by vendor name.