First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2013-1744

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Jan 25, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-17475.0channel.c in ngIRCd 20 and 20.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a KICK command for a CVE-2013-17487.5Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified pa CVE-2013-17494.3Cross-site scripting (XSS) vulnerability in edit.php in PHP Address Book 8.2.5 allows user-assisted remote attackers to inject arbitrary web CVE-2013-17509.3Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execut CVE-2013-17519.8TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containin CVE-2013-17537.5The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory CVE-2013-17567.5The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitr CVE-2013-17584.3Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary we CVE-2013-17594.3Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary w CVE-2013-17606.1The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities CVE-2013-17626.6stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer convers CVE-2013-17637.2Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain p

CVE-2013-1744: Critical severity, CVSS 9.8 | Vulnix