CVE-2013-1412

High

Published: 02/06/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

DataLife Engine (DLE) version 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.

Risk Assessment

Exploitation of this vulnerability could lead to complete server compromise, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update DataLife Engine to the latest version to eliminate this vulnerability and implement appropriate server-level security measures.

Other vulnerabilities in DataLife Engine 9.7

CVE-2026-96604High
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Original NVD description (English source)

DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS