CVE-2014-2664

Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

• CWE-434

• http://karmainsecurity.com/KIS-2014-04Third Party Advisory
• http://secunia.com/advisories/57315Third Party Advisory
• http://www.securityfocus.com/bid/66506/discussThird Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92169Third Party Advisory, VDB Entry
• https://secuniaresearch.flexerasoftware.com//secunia_research/2014-4Third Party Advisory
• http://karmainsecurity.com/KIS-2014-04Third Party Advisory
• http://secunia.com/advisories/57315Third Party Advisory
• http://www.securityfocus.com/bid/66506/discussThird Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92169Third Party Advisory, VDB Entry
• https://secuniaresearch.flexerasoftware.com//secunia_research/2014-4Third Party Advisory

Published

Oct 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2654Multiple SQL injection vulnerabilities in MobFox mAdserve 2.…
• CVE-2014-2655SQL injection vulnerability in the gen_show_status function …
• CVE-2014-2656Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-2657Unspecified vulnerability in the print release functionality…
• CVE-2014-2658Unspecified vulnerability in Papercut MF and NG before 14.1 …
• CVE-2014-2659Cross-site request forgery (CSRF) vulnerability in the admin…
• CVE-2014-2665includes/specials/SpecialChangePassword.php in MediaWiki bef…
• CVE-2014-2667Race condition in the _get_masked_mode function in Lib/os.py…
• CVE-2014-2668Apache CouchDB 1.5.0 and earlier allows remote attackers to …
• CVE-2014-2669Multiple integer overflows in contrib/hstore/hstore_io.c in …
• CVE-2014-2670Cross-site scripting (XSS) vulnerability in Properties.do in…
• CVE-2014-2671Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows r…