CVE-2014-4170

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/127701/Free-Reprintables-ArticleFR-11.06.2014-Improper-Access-Control.htmlThird Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/34245Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95051Third Party Advisory, VDB Entry
https://www.securityfocus.com/bid/68980Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/127701/Free-Reprintables-ArticleFR-11.06.2014-Improper-Access-Control.htmlThird Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/34245Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95051Third Party Advisory, VDB Entry
https://www.securityfocus.com/bid/68980Third Party Advisory, VDB Entry

Timeline

Published: Feb 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-41714.7mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, whic CVE-2014-41729.8A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client be CVE-2014-41749.3wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitrary code or cause a CVE-2014-41874.3Cross-site scripting (XSS) vulnerability in signup.php in ClipBucket allows remote attackers to inject arbitrary web script or HTML via the CVE-2014-41886.8Cross-site request forgery (CSRF) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Manage CVE-2014-41894.3Cross-site scripting (XSS) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - CVE-2014-41907.8Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9 CVE-2014-41915.0The TLS implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) sends a long series of random bytes during use of the Dual_EC_D CVE-2014-41925.0The Dual_EC_DRBG implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) processes certain requests for output bytes by conside CVE-2014-41935.0The TLS implementation in EMC RSA BSAFE-Java Toolkits (aka Share for Java) supports the Extended Random extension during use of the Dual_EC_CVE-2014-41947.5SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the ar CVE-2014-41954.3Cross-site scripting (XSS) vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or H