Live › vulnerability › CVE-2014-125138
Go to dashboardC97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6 and Cart Engine through 3.0.0 accept unrestricted file uploads in administrative image fields. An editor-role user can upload a PHP script to the web-accessible /public/image directory and request it to run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Sites running one of these three products at or below the listed versions, where editor-role accounts can use the page_image or cat_image upload fields. Installations without these products, or where the upload directory does not execute PHP, are less exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
/public/image is web-accessible and contains any .php files.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
This page as .md · .json · in your agent: get_signal("CVE-2014-125138")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.