Description

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.

Remediation

References

CVE-2014-7985

Related Vulnerabilities

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2023-0216)

Grafana CVE-2024-1442 Vulnerability (CVE-2024-1442)

WordPress Plugin Classified Listing Store & Membership Cross-Site Scripting (1.4.19)

WordPress Plugin NewStatPress Multiple Vulnerabilities (1.0.4)

WordPress Plugin Custom 404 Pro Cross-Site Scripting (3.2.8)

Severity

Critical

Classification

CVE-2014-7985 CWE-22

Tags

Missing Update Known Vulnerabilities