CVE-2014-5297
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8...
CVE-2014-5297 is a high vulnerability (CVSS 7.5) in X2engine, published October 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 85th percentile. No source names a fixed version.
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
Exploit likelihood
What each source reports
NVD Score used
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
- Record
CVE-2014-5297- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
- Record
CVE-2014-5297- Updated
- 2026-11-02
EUVDEUVD-2014-5188 No score
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
- Record
EUVD-2014-5188- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8pcr-qrf2-5hpg No score
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8...
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.
- Record
GHSA-8pcr-qrf2-5hpg- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
packetstormsecurity.com/files/128352/X2Engine-4.1.7-PHP-Object-Injection.html
x2community.com/topic/1804-important-security-patch
securityfocus.com/archive/1/533513/100/0/threaded
karmainsecurity.com/KIS-2014-09
seclists.org/fulldisclosure/2014/Sep/77
nvd.nist.gov/vuln/detail/CVE-2014-5297
github.com/advisories/GHSA-8pcr-qrf2-5hpg