CVE-2014-2294

9.8 criticalEPSS 2.7%

Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2018-04-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openwebanalytics:open_web_analytics

References

http://karmainsecurity.com/KIS-2014-03
http://www.openwebanalytics.com/?p=388
https://secuniaresearch.flexerasoftware.com/advisories/56999
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/
https://www.securityfocus.com/bid/66076

Check your stack JSON