{"id":"CVE-2014-9235","aliases":["DEBIAN-CVE-2014-9235","EUVD-2014-9060","GHSA-3mrr-pqw6-73rq","UBUNTU-CVE-2014-9235"],"status":"published","title":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier...","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02002,"percentile":0.80917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2014-12-03T21:00:00Z","modified":"2026-10-23T15:47:23Z","exploits":[{"source":"exploitdb","id":"EDB-35278","title":"Zoph 0.9.1 - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2014-11-17","url":"https://www.exploit-db.com/exploits/35278"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-3","1.0.1-4","1.0.1-5","1.4-1","1.4-2","1.4-3"]},{"source":"osv","ecosystem":"Debian:13","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]},{"source":"osv","ecosystem":"Debian:14","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.4-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.11-1","0.9.11-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.16-1","0.9.17-2","0.9.18-1","0.9.19-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-5","1.4-2","1.4-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]}],"products":[{"vendor":"zoph","product":"zoph"}],"references":[{"url":"http://packetstormsecurity.com/files/129141/Zoph-0.9.1-Cross-Site-Scripting-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://seclists.org/fulldisclosure/2014/Nov/45","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9235"},{"url":"https://github.com/advisories/GHSA-3mrr-pqw6-73rq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9235","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9235","tags":["report"]},{"url":"https://github.com/jeroenrnl/zoph/issues/59","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9235","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9235","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2014-12-03T21:00:00Z","modified":"2024-09-17T00:37:10.191Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9060","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2014-12-03T21:00:00Z","modified":"2024-09-17T00:37:10Z","updated_at":"2026-11-03T00:28:57.378482Z"}],"ghsa":[{"id":"GHSA-3mrr-pqw6-73rq","title":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier...","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2022-05-17T04:20:37Z","modified":"2023-01-28T05:01:40Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:43:36.521425Z"}],"nvd":[{"id":"CVE-2014-9235","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2014-12-03T21:59:05.197Z","modified":"2026-06-17T00:17:58.2Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-9235","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2014-12-03T21:59:05Z","modified":"2026-04-10T03:44:47.190438Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9235","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2014-12-03T21:59:05.197Z","modified":"2026-10-23T15:47:23.750119522Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9235","description":"Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.","status":"published","published":"2014-12-03T21:59:00Z","modified":"2026-10-17T12:52:49.292578144Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}