CVE-2014-2935: Improper Neutralization of Special Elements used in an OS Command

costview3/xmlrpcserver/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request...