EUVD-2014-5407

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

SQL injection vulnerability in XRMS CRM allows remote attackers to execute SQL commands via user_id parameter.

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2014-5520	26 Oct 201420:00	–	cve
Cvelist	CVE-2014-5520	26 Oct 201420:00	–	cvelist
NVD	CVE-2014-5520	26 Oct 201420:55	–	nvd
Prion	Sql injection	26 Oct 201420:55	–	prion

[
  {
    "enisaIdVendor": [
      {
        "id": "8de6c960-4188-3237-a88c-c1cd4e67f407",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "66b61912-0305-3b26-a7a8-fec5366151d4",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/128030/XRMS-Blind-SQL-Injection-Command-Execution.html
securityfocus	www.securityfocus.com/bid/69446
seclists	www.seclists.org/fulldisclosure/2014/Aug/78
openwall	www.openwall.com/lists/oss-security/2014/08/27/4
openwall	www.openwall.com/lists/oss-security/2014/08/29/1
exploit-db	www.exploit-db.com/exploits/34452
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

6.4Medium risk

Vulners AI Score6.4

CVSS 27.5

EPSS0.05965