CVE-2014-1691
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1...
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
Exploit likelihood
What each source reports
NVD Score used
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
CVE-2014-1691- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
CVE-2014-1691- Updated
- 2026-11-02
EUVDEUVD-2014-1765 No score
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
EUVD-2014-1765- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vrpw-h28p-3rfp No score
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1...
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
GHSA-vrpw-h28p-3rfp- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
CVE-2014-1691- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1691 No score
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
DEBIAN-CVE-2014-1691- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1691 No score
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
- Record
UBUNTU-CVE-2014-1691- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-horde-utilDebian:12 |
before 2.3.0-1 | 2.3.0-1 |
horde3Debian:6.0 |
before 3.3.8+debian0-3 | 3.3.8+debian0-3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Horde Framework - Unserialize PHP Code Execution (Metasploit) | 2014-03-22 |
| Metasploit | Horde Framework Unserialize PHP Code Execution | 2013-06-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1691 is a high vulnerability (CVSS 7.5) in Horde Application Framework, published February 5, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 42.9%, the 98th percentile. Fixed in php-horde-util 2.3.0-1.