Dashboard / CVE-2014-125137

CVE-2014-125137

HIGH
MEDIUM Priority: 0.05 BB Relevance: 64/100
Published: 2026-10-28 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: None
VA: None

Description

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
C97net qEngine CMS 0

References & Advisories (8)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.72%
Raw Score 0.007180
Percentile 53.8%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links