CVE-2014-6446

high · 7.5

The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.

7.5

CVSS

46.2%

EPSS (exploit prob.)

99th

EPSS percentile

2014-09-26

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.3
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.4
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.4.1
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.4.2
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.5
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.6
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.7
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.7.1
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.7.2
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.8
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.8.1
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.9
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.9.1
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.9.2
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.9.3
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.9.4
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.9.5
infusionsoft_gravity_forms_project	infusionsoft_gravity_forms	1.5.10

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-6446