CVE-2014-5140

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce...

8.8 HighPublic exploit

CVE-2014-5140 is a high vulnerability (CVSS 8.8) in Loadedcommerce Loaded7, published January 3, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.68%, the 85th percentile. No source names a fixed version.

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.68%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2014-5140
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-5140
Updated: 2026-11-02

EUVDEUVD-2014-5038 No score

Record: EUVD-2014-5038
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jq73-v9pp-jgx4 No score

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce...

Record: GHSA-jq73-v9pp-jgx4
Updated: 2026-11-02

Affected products

loadedcommerce loaded7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	LoadedCommerce7 - Systemic Query Factory	2014-09-07

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD