CVE-2014-0342

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-15 · updated 2026-06-17

Description

Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

Affected products

Pivotx: through 2.3.8; 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.0-b1, 2.2.0-b2 (+11)

References

http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
http://pivotx.net/page/security
http://sourceforge.net/p/pivot-weblog/code/4347/
http://www.kb.cert.org/vuls/id/901156
http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released
http://pivotx.net/page/security
http://sourceforge.net/p/pivot-weblog/code/4347/
http://www.kb.cert.org/vuls/id/901156

Get alerted when CVE-2014-0342 or the next vulnerability affects your stack