High severity8.8NVD Advisory· Published Oct 17, 2017· Updated Jun 17, 2026
CVE-2014-2664
CVE-2014-2664
Description
Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Patches
Vulnerability mechanics
References
5- karmainsecurity.com/KIS-2014-04nvdThird Party Advisory
- secunia.com/advisories/57315nvdThird Party Advisory
- www.securityfocus.com/bid/66506/discussnvdThird Party AdvisoryVDB Entry
- exchange.xforce.ibmcloud.com/vulnerabilities/92169nvdThird Party AdvisoryVDB Entry
- secuniaresearch.flexerasoftware.com//secunia_research/2014-4nvdThird Party Advisory
News mentions
0No linked articles in our index yet.