Vulnerability record · CVE-2014-2223 · published 11 September 2014

CVE-2014-2223: Plogger code injection vulnerability

Plogger · Plogger

Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct request to it in plog-content/uploads/archive/.

7.5 CVSS 2.0 High EPSS 10% · top 4.5% CWE-94 · Code injection

7.5CVSS 2.0 base score

10%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References, 8 tagged exploit

17 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Plogger Plogger

References

Link	Tags
http://packetstormsecurity.com/files/128029/Plogger-Authenticated-Arbitrary-File-Upload.html	Exploit
http://seclists.org/oss-sec/2014/q1/443
http://seclists.org/oss-sec/2014/q1/446	Exploit
http://www.exploit-db.com/exploits/34447	Exploit
https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224
https://www.sysdream.com/system/files/PLOGGER-1.0RC1-advisory.pdf	Exploit
http://packetstormsecurity.com/files/128029/Plogger-Authenticated-Arbitrary-File-Upload.html	Exploit
http://seclists.org/oss-sec/2014/q1/443
http://seclists.org/oss-sec/2014/q1/446	Exploit
http://www.exploit-db.com/exploits/34447	Exploit
https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224
https://www.sysdream.com/system/files/PLOGGER-1.0RC1-advisory.pdf	Exploit

Track CVE-2014-2223 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2012-5289Plogger sql injection vulnerabilityMultiple SQL injection vulnerabilities in Plogger 1.0 RC1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) index.…EPSS 1.3%4 Oct 2012 7.5CVE-2008-3563Plogger sql injection vulnerabilityMultiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the checked array …EPSS 2.4%10 Aug 2008 7.5CVE-2007-6587Plogger sql injection vulnerabilitySQL injection vulnerability in plog-rss.php in Plogger 1.0 Beta 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.EPSS 3.4%28 Dec 2007 7.5CVE-2007-2277Plogger improper authentication vulnerabilitySession fixation vulnerability in Plogger allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.EPSS 1.4%25 Apr 2007 7.5CVE-2006-2157Plogger sql injection vulnerabilitySQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id param…EPSS 1.1%3 May 2006 7.5CVE-2005-4573Plogger code injection vulnerabilityPHP remote file include vulnerability in plog-admin-functions.php in Plogger Beta 2 allows remote attackers to execute arbitrary code via a URL in th…EPSS 12%29 Dec 2005 7.5CVE-2005-4246Plogger sql injection vulnerabilitySQL injection vulnerability in Plogger Beta 2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to index…EPSS 1.1%14 Dec 2005 5.0CVE-2014-2224Plogger vulnerabilityPlogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote attackers t…EPSS 1.4%29 Dec 2014

Source: NIST National Vulnerability Database (record CVE-2014-2223), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.