CVE-2017-14535

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

• CWE-78

• http://packetstormsecurity.com/files/162854/Trixbox-2.8.0.4-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/103004Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14535-ExploitExploit, Third Party Advisory
• https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/Exploit, Third Party Advisory
• https://twitter.com/tiger_tigerboy/status/962689803270500352Third Party Advisory
• https://www.linkedin.com/pulse/trixbox-os-command-injection-vulnerability-sachin-wagh-ceh-ecsa-/?published=tExploit, Third Party Advisory
• http://packetstormsecurity.com/files/162854/Trixbox-2.8.0.4-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/103004Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14535-ExploitExploit, Third Party Advisory
• https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/Exploit, Third Party Advisory
• https://twitter.com/tiger_tigerboy/status/962689803270500352Third Party Advisory
• https://www.linkedin.com/pulse/trixbox-os-command-injection-vulnerability-sachin-wagh-ceh-ecsa-/?published=tExploit, Third Party Advisory

Published

Feb 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1453IBM Security Access Manager Appliance 9.0.3 could allow a re…
• CVE-2017-14530WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7…8
• CVE-2017-14531ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUN…
• CVE-2017-14532ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIg…
• CVE-2017-14533ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in cod…
• CVE-2017-14534Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.2012…
• CVE-2017-14536trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.ph…
• CVE-2017-14537trixbox 2.8.0.4 has path traversal via the xajaxargs array p…6.5
• CVE-2017-14538XnView Classic for Windows Version 2.40 allows attackers to …
• CVE-2017-14539IrfanView 4.44 - 32bit allows attackers to cause a denial of…
• CVE-2017-14540IrfanView 4.44 - 32bit allows attackers to cause a denial of…
• CVE-2017-14541XnView Classic for Windows Version 2.40 allows attackers to …