Unrated severityNVD Advisory· Published Sep 2, 2014· Updated Jun 17, 2026

CVE-2014-5521

Description

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xrms/CRM2 versions
cpe:2.3:a:xrms_crm_project:xrms_crm:1.99.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:xrms_crm_project:xrms_crm:1.99.2:*:*:*:*:*:*:*
- (no CPE)range: <=1.99.2

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/128030/XRMS-Blind-SQL-Injection-Command-Execution.htmlnvdExploit
www.exploit-db.com/exploits/34452nvdExploit
www.openwall.com/lists/oss-security/2014/08/27/4nvdExploit
seclists.org/fulldisclosure/2014/Aug/78nvd
www.openwall.com/lists/oss-security/2014/08/29/1nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.006
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000