CVE-2014-8731

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/129089/PHPMemcachedAdmin-1.2.2-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/533968/100/0/threaded
http://www.securityfocus.com/archive/1/533980/100/0/threaded
http://www.securityfocus.com/bid/71059Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98638
http://packetstormsecurity.com/files/129089/PHPMemcachedAdmin-1.2.2-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/533968/100/0/threaded
http://www.securityfocus.com/archive/1/533980/100/0/threaded
http://www.securityfocus.com/bid/71059Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98638

Timeline

Published: Mar 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-87324.3Cross-site scripting (XSS) vulnerability in phpMemcachedAdmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HT CVE-2014-87332.1Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, w CVE-2014-87343.5The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pag CVE-2014-87354.0The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote CVE-2014-87365.0The Open Atrium Core module for Drupal before 7.x-2.22 allows remote attackers to bypass access restrictions and read file attachments that CVE-2014-87373.6Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot)CVE-2014-87385.0The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of s CVE-2014-87399.8Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Cre CVE-2014-87419.8Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers CVE-2014-87427.5Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers t CVE-2014-87433.5Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users CVE-2014-87443.5Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with