CVE-2014-5297

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery SSRF attacks via crafted serialized data in the report parameter...

PT-2014-6392

Name of the Vulnerable Software and Affected Versions X2Engine versions 2.8 through 4.1.7 Description The issue allows remote attackers to conduct PHP object injection and Server-Side Request Forgery SSRF attacks. This is achieved by sending crafted serialized data in the report parameter to the...

CVE-2014-5297: Improper Control of Generation of Code

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery SSRF attacks via crafted serialized data in the report parameter...