CVE-2014-9521

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-95224.3Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web scripCVE-2014-95236.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress alloCVE-2014-95246.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for WordCVE-2014-95256.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackeCVE-2014-95264.3Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web CVE-2014-95275.0HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT CVE-2014-95287.5SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10CVE-2014-95296.9Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denCVE-2014-95309.8A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact.CVE-2014-95565.0Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CVE-2014-95576.1Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2.CVE-2014-95589.8Multiple SQL injection vulnerabilities in SmartCMS v.2.