CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2014-2737

SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 52.1%

CVSS Severity

CVSS v2 Score 7.5

References

Products affected by CVE-2014-2737

Knowledgetree » Knowledgetree » Version: 3.5

cpe:2.3:a:knowledgetree:knowledgetree:3.5
Knowledgetree » Knowledgetree » Version: 3.5.2

cpe:2.3:a:knowledgetree:knowledgetree:3.5.2
Knowledgetree » Knowledgetree » Version: 3.5.4

cpe:2.3:a:knowledgetree:knowledgetree:3.5.4
Knowledgetree » Knowledgetree » Version: 3.5.4a

cpe:2.3:a:knowledgetree:knowledgetree:3.5.4a
Knowledgetree » Knowledgetree » Version: 3.6

cpe:2.3:a:knowledgetree:knowledgetree:3.6
Knowledgetree » Knowledgetree » Version: 3.7

cpe:2.3:a:knowledgetree:knowledgetree:3.7
Knowledgetree » Knowledgetree » Version: 3.7.0.1

cpe:2.3:a:knowledgetree:knowledgetree:3.7.0.1
Knowledgetree » Knowledgetree » Version: 3.7.0.2

cpe:2.3:a:knowledgetree:knowledgetree:3.7.0.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2014-2737

Products

Pricing

Contact Us