CVE-2014-8739

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

• CWE-434

• http://osvdb.org/show/osvdb/113669Broken Link
• http://osvdb.org/show/osvdb/113673Broken Link
• http://www.openwall.com/lists/oss-security/2014/11/11/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/11/11/5Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/11/13/3Mailing List, Third Party Advisory
• https://wordpress.org/plugins/sexy-contact-form/changelog/Third Party Advisory
• https://www.exploit-db.com/exploits/35057/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/36811/Exploit, Third Party Advisory, VDB Entry
• http://osvdb.org/show/osvdb/113669Broken Link
• http://osvdb.org/show/osvdb/113673Broken Link
• http://www.openwall.com/lists/oss-security/2014/11/11/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/11/11/5Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/11/13/3Mailing List, Third Party Advisory
• https://wordpress.org/plugins/sexy-contact-form/changelog/Third Party Advisory
• https://www.exploit-db.com/exploits/35057/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/36811/Exploit, Third Party Advisory, VDB Entry

Published

Feb 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8733Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bin…
• CVE-2014-8734The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 …
• CVE-2014-8735The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.…
• CVE-2014-8736The Open Atrium Core module for Drupal before 7.x-2.22 allow…
• CVE-2014-8737Multiple directory traversal vulnerabilities in GNU binutils…
• CVE-2014-8738The _bfd_slurp_extended_name_table function in bfd/archive.c…
• CVE-2014-8741Directory traversal vulnerability in the GfdFileUploadServer…9.8
• CVE-2014-8742Directory traversal vulnerability in the ReportDownloadServl…7.5
• CVE-2014-8743Multiple cross-site scripting (XSS) vulnerabilities in the M…
• CVE-2014-8744Cross-site scripting (XSS) vulnerability in the Nivo Slider …
• CVE-2014-8745Cross-site scripting (XSS) vulnerability in the Custom Searc…
• CVE-2014-8746Cross-site scripting (XSS) vulnerability in the Skeleton the…