Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2014-8142

🗓️ 20 Dec 2014 11:00:00Reported by redhatType 
cve
 cve🔗 web.nvd.nist.gov👁 359 Views🌐 WEB

Use-after-free vulnerability in process_nested_data function in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via crafted unserialize call

Related
Detection
Refs
Paths
ReporterTitlePublishedViews
Family
zdt
zdt		eFront 3.6.15 - Multiple Vulnerabilities
11 May 201500:00
–zdt
zdt
zdt		Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple Vulnerabiliti
22 Sep 201600:00
–zdt
nessus
Tenable Nessus		PHP 5.4.x < 5.4.36 / 5.5.x < 5.5.20 / 5.6.x < 5.6.4 Use-After-Free
23 Dec 201400:00
–nessus
nessus
Tenable Nessus		Amazon Linux AMI : php54 (ALAS-2015-463)
9 Jan 201500:00
–nessus
nessus
Tenable Nessus		Amazon Linux AMI : php55 (ALAS-2015-464)
9 Jan 201500:00
–nessus
nessus
Tenable Nessus		Amazon Linux AMI : php55 (ALAS-2015-474)
13 Feb 201500:00
–nessus
nessus
Tenable Nessus		Amazon Linux AMI : php54 (ALAS-2015-475)
13 Feb 201500:00
–nessus
nessus
Tenable Nessus		CentOS 7 : php (CESA-2015:1135)
24 Jun 201500:00
–nessus
nessus
Tenable Nessus		Debian DSA-3117-1 : php5 - security update
2 Jan 201500:00
–nessus
nessus
Tenable Nessus		EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1543)
14 May 201900:00
–nessus
Rows per page
NVD
Node
OR
phpphpRange≤5.4.35
phpphpMatch5.5.0
phpphpMatch5.5.0alpha1
phpphpMatch5.5.0alpha2
phpphpMatch5.5.0alpha3
phpphpMatch5.5.0alpha4
phpphpMatch5.5.0alpha5
phpphpMatch5.5.0alpha6
phpphpMatch5.5.0beta1
phpphpMatch5.5.0beta2
phpphpMatch5.5.0beta3
phpphpMatch5.5.0beta4
phpphpMatch5.5.0rc1
phpphpMatch5.5.0rc2
phpphpMatch5.5.1
phpphpMatch5.5.2
phpphpMatch5.5.3
phpphpMatch5.5.4
phpphpMatch5.5.5
phpphpMatch5.5.6
phpphpMatch5.5.7
phpphpMatch5.5.8
phpphpMatch5.5.9
phpphpMatch5.5.10
phpphpMatch5.5.11
phpphpMatch5.5.12
phpphpMatch5.5.13
phpphpMatch5.5.14
phpphpMatch5.5.15
phpphpMatch5.5.16
phpphpMatch5.5.17
phpphpMatch5.5.18
phpphpMatch5.5.19
phpphpMatch5.6.0
phpphpMatch5.6.0alpha1
phpphpMatch5.6.0alpha2
phpphpMatch5.6.0alpha3
phpphpMatch5.6.0alpha4
phpphpMatch5.6.0alpha5
phpphpMatch5.6.0beta1
phpphpMatch5.6.0beta2
phpphpMatch5.6.0beta3
phpphpMatch5.6.0beta4
phpphpMatch5.6.1
phpphpMatch5.6.2
phpphpMatch5.6.3
ParameterPositionPathDescriptionCWE
sbctgquery param/www/new_sidebar.php?sbctg=lessons&new_lesson_id=null+union+select+password+from+users+where+id=1SQL injection via new_sidebar.php allowing retrieval of usernames/passwords from users table.CWE-89
new_lesson_idquery param/www/new_sidebar.php?sbctg=lessons&new_lesson_id=null+union+select+password+from+users+where+id=1SQL injection via new_sidebar.php allowing retrieval of usernames/passwords from users table.CWE-89
actionquery param/www/view_file.php?action=download&file=/[EFRONT_BASE_PATH]/../../../../../../etc/passwd/Path traversal to access /etc/passwd via file parameter.CWE-22
filequery param/www/view_file.php?action=download&file=/[EFRONT_BASE_PATH]/../../../../../../etc/passwd/Path traversal to access /etc/passwd via file parameter.CWE-22
transferedquery param/test/efront/www/professor.php?ctg=copy&from=8&node_orders=&transfered=[SERIALIZED_ARBITRARY_OBJECT]&mode=ajax&csrf_id=6ebb0b3aee60a1764e780e8494985a8ePHP Object Injection via unserialize in copy.php through transfered parameter.CWE-502
ctgquery param/test/efront/www/professor.php?ctg=copy&from=8&node_orders=&transfered=[SERIALIZED_ARBITRARY_OBJECT]&mode=ajax&csrf_id=6ebb0b3aee60a1764e780e8494985a8ePHP Object Injection via unserialize in copy.php through transfered parameter.CWE-502
fromquery param/test/efront/www/professor.php?ctg=copy&from=8&node_orders=&transfered=[SERIALIZED_ARBITRARY_OBJECT]&mode=ajax&csrf_id=6ebb0b3aee60a1764e780e8494985a8ePHP Object Injection via unserialize in copy.php through transfered parameter.CWE-502
node_ordersquery param/test/efront/www/professor.php?ctg=copy&from=8&node_orders=&transfered=[SERIALIZED_ARBITRARY_OBJECT]&mode=ajax&csrf_id=6ebb0b3aee60a1764e780e8494985a8ePHP Object Injection via unserialize in copy.php through transfered parameter.CWE-502
modequery param/test/efront/www/professor.php?ctg=copy&from=8&node_orders=&transfered=[SERIALIZED_ARBITRARY_OBJECT]&mode=ajax&csrf_id=6ebb0b3aee60a1764e780e8494985a8ePHP Object Injection via unserialize in copy.php through transfered parameter.CWE-502
csrf_idquery param/test/efront/www/professor.php?ctg=copy&from=8&node_orders=&transfered=[SERIALIZED_ARBITRARY_OBJECT]&mode=ajax&csrf_id=6ebb0b3aee60a1764e780e8494985a8ePHP Object Injection via unserialize in copy.php through transfered parameter.CWE-502
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 00:16Current
8High risk
Vulners AI Score8
CVSS 27.5
EPSS0.53166
cve-2014-8142phpvulnerabilityremote code executionunserializecve-2004-1019
359