CVE-2014-2293

9.8 criticalEPSS 4.7%

Critical (9.8) in zikula zikula application framework. EPSS 4.7% chance of exploitation in the next 30 days.

Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentication_method_ser or (2) authentication_info_ser parameter to index.php, or (3) zikulaMobileTheme parameter to index.php.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.7% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2018-03-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zikula:zikula_application_framework

References

http://karmainsecurity.com/KIS-2014-02
https://exchange.xforce.ibmcloud.com/vulnerabilities/91786
https://exchange.xforce.ibmcloud.com/vulnerabilities/91787
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-2/
http://karmainsecurity.com/KIS-2014-02

Check your stack JSON