CVE-2014-5387
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2014-5387
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
EllisLab ExpressionEngine SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
EllisLab ExpressionEngine是美国EllisLab公司的一套内容管理系统（CMS），它提供Web发布、模板引擎和附件组件等模块。 EllisLab ExpressionEngine 2.9.1之前版本中存在SQL注入漏洞，该漏洞源于system/index.php脚本没有充分过滤‘column_filter’或‘category[]’参数；system/index.php脚本没有充分过滤comment组件中的‘tbl_sort[0][]’参数。远程攻击者可利用该漏洞执行任意SQL命令
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2014-5387
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2014-5387
请登录查看更多情报信息。
Vendor Advisories for CVE-2014-5387 (1)
Exploits & Public PoCs for CVE-2014-5387 (1)
Mailing List Discussions for CVE-2014-5387 (1)
- 🔗 Full Disclosure: CVE-2014-5387 - Multiple Authenticated SQL Injections in EllisLab ExpressionEngine Core Read full article mailing-listx_refsource_FULLDISC
Other References for CVE-2014-5387 (2)
Same Patch Batch · n/a · 2014-11-04 · 46 CVEs total
| CVE-2013-7057 | Axway SecureTransport 跨站请求伪造漏洞 | |
| CVE-2014-8584 | WordPress Web Dorado Spider Video Player插件跨站脚本漏洞 | |
| CVE-2014-8586 | WordPress CP Multi View Event Calendar插件‘calid’参数SQL注入漏洞 | |
| CVE-2014-8589 | SAP Network Interface Router 整数溢出漏洞 | |
| CVE-2014-8590 | SAP NetWeaver Application Server Java XML外部实体漏洞 | |
| CVE-2014-8591 | SAP Internet Communication Manager 拒绝服务漏洞 | |
| CVE-2014-8592 | SAP Host Agent 拒绝服务漏洞 | |
| CVE-2014-4311 | Epicor Enterprise 信息泄露漏洞 | |
| CVE-2014-8588 | SAP HANA SQL注入漏洞 | |
| CVE-2014-7176 | Enalean Tuleap SQL注入漏洞 | |
| CVE-2014-8339 | Nuevolab Nuevoplayer for ClipShare SQL注入漏洞 | |
| CVE-2014-8593 | Allomani Weblinks 跨站脚本漏洞 | |
| CVE-2014-4974 | ESET Personal Firewall NDIS filter内核模式驱动程序信息泄露漏洞 | |
| CVE-2014-3660 | Libxml2 拒绝服务漏洞 | |
| CVE-2014-7875 | HP LaserJet CM3530 Multifunction Printer CC519A和CC520A 远程拒绝服务漏洞 | |
| CVE-2014-6130 | IBM Notes Traveler For Android 信息泄露漏洞 | |
| CVE-2014-8474 | CA Cloud Service Management 安全漏洞 | |
| CVE-2014-8473 | CA Cloud Service Management 跨站请求伪造漏洞 | |
| CVE-2014-8472 | CA Cloud Service Management 安全漏洞 | |
| CVE-2014-8471 | CA Cloud Service Management 安全漏洞 |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2014-5387
No comments yet