VULNERABILITY INTELLIGENCE
CVE-2014-1683
CVSS score6.8 MEDIUM
EPSS probability31.41%
CISA KEVNot currently listed
Published2014-01-29
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Weakness classification
- CWE-134: Use of Externally-Controlled Format String