CVE-2014-8084
HighSummary
CVE-2014-8084 in OSClass before version 3.4.3 has a directory traversal vulnerability that allows remote attackers to include and execute arbitrary local files.
Risk Assessment
Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade OSClass to version 3.4.3 or later to mitigate this vulnerability.
Other vulnerabilities in OSClass
See all- CVE-2014-8083High
SQL injection vulnerability in the Search::setJsonAlert method in OSClass before version 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.
- CVE-2026-113381High
A weakness has been identified in Osclass up to 8.3.1. Affected is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the Item Model Handler component. Manipulation of the sPattern argument causes SQL injection. The attack may be initiated remotely and the exploit has been made public. The vendor was contacted early but did not respond.
Original NVD description (English source)
Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS