CVE-2014-5140
Public Exploits 1
ExploitDB · 1 EDB-34552 [webapps]
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2014-5140
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Loaded Commerce SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Loaded Commerce是美国Loaded Commerce公司的一套开源的电子商务平台。 Loaded Commerce 7版本中存在SQL注入漏洞，该漏洞源于includes/classes/database.php文件中的‘bindReplace’函数没有正确处理‘:’字符。攻击者可借助First name和Last name字段利用该漏洞控制应用程序，访问或修改数据，或利用底层数据库中潜在的漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2014-5140
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2014-5140
请登录查看更多情报信息。
Patches & Fixes for CVE-2014-5140 (1)
- https://github.com/loadedcommerce/loaded7/pull/520x_refsource_MISC
Vendor Advisories for CVE-2014-5140 (1)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95791x_refsource_MISC
Exploits & Public PoCs for CVE-2014-5140 (2)
- http://www.exploit-db.com/exploits/34552x_refsource_MISC
Other References for CVE-2014-5140 (1)
Same Patch Batch · n/a · 2020-01-03 · 40 CVEs total
| CVE-2019-5304 | Huawei CloudEngine 12800 安全漏洞 | |
| CVE-2019-19257 | GitLab 信息泄露漏洞 | |
| CVE-2019-19256 | GitLab 信息泄露漏洞 | |
| CVE-2019-19255 | GitLab 安全漏洞 | |
| CVE-2019-19254 | GitLab 信息泄露漏洞 | |
| CVE-2019-19088 | GitLab 路径遍历漏洞 | |
| CVE-2019-19087 | GitLab 信息泄露漏洞 | |
| CVE-2019-19086 | GitLab 信息泄露漏洞 | |
| CVE-2019-19311 | GitLab 跨站脚本漏洞 | |
| CVE-2020-1785 | 多款Huawei产品输入验证错误漏洞 | |
| CVE-2019-19258 | GitLab 信息泄露漏洞 | |
| CVE-2020-1871 | Huawei USG9500 安全漏洞 | |
| CVE-2019-19441 | Huawei P30 信息泄露漏洞 | |
| CVE-2019-20330 | FasterXML jackson-databind 代码问题漏洞 | |
| CVE-2020-5310 | Pillow 输入验证错误漏洞 | |
| CVE-2020-5311 | Pillow 缓冲区错误漏洞 | |
| CVE-2020-5312 | Pillow 缓冲区错误漏洞 | |
| CVE-2020-5313 | Pillow 缓冲区错误漏洞 | |
| CVE-2020-5395 | FontForge 资源管理错误漏洞 | |
| CVE-2020-5496 | FontForge 缓冲区错误漏洞 |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-9422
KLiK SocialMediaWebsite HTTP POST Request Parameter injectio - CVE-2026-9421
KLiK SocialMediaWebsite File upload.inc.php uniqid unrestric - CVE-2026-9420
KLiK SocialMediaWebsite HTTP GET Request Parameter injection - CVE-2026-9376
JPress UCenter Article Submission Endpoint doWriteSave impro - CVE-2026-9373
JeecgBoot OpenAPI Endpoint call improper authentication
V. Comments for CVE-2014-5140
No comments yet