← Vulnerability feed

Vulnerability record · CVE-2014-4663 · published 15 July 2014

CVE-2014-4663: Binarymoon timthumb code injection vulnerability

Binarymoon · Timthumb

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.

6.8 CVSS 2.0 Medium EPSS 9.8% · top 4.6% CWE-94 · Code injection
6.8CVSS 2.0 base score
9.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
16References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/127192/TimThumb-2.8.13-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2014/Jul/4
http://seclists.org/fulldisclosure/2014/Jun/117
http://seclists.org/oss-sec/2014/q2/689
http://secunia.com/advisories/59558
http://www.exploit-db.com/exploits/33851 Exploit
https://code.google.com/p/timthumb/issues/detail?id=485
https://code.google.com/p/timthumb/source/detail?r=219
http://packetstormsecurity.com/files/127192/TimThumb-2.8.13-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2014/Jul/4
http://seclists.org/fulldisclosure/2014/Jun/117
http://seclists.org/oss-sec/2014/q2/689
http://secunia.com/advisories/59558
http://www.exploit-db.com/exploits/33851 Exploit
https://code.google.com/p/timthumb/issues/detail?id=485
https://code.google.com/p/timthumb/source/detail?r=219

Track CVE-2014-4663 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.8CVE-2011-4106Binarymoon timthumb improper input validation vulnerabilityTimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execut…EPSS 23%4.3CVE-2010-5302Binarymoon timthumb cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote at…EPSS 0.93%4.3CVE-2010-5303Binarymoon timthumb cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, al…EPSS 0.94%4.3CVE-2009-5142Binarymoon timthumb cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote a…EPSS 1.2%8.8CVE-2026-65660Microsoft sharepoint server code injection vulnerabilityImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.KEVEPSS 2.1%9.8CVE-2026-60004Gitea diffpatch API code injection enables remote code executionGitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-9…KEVEPSS 24%analysed9.5CVE-2026-72530TrueConf Server sandbox breakout via crafted script code injectionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break o…KEVEPSS 1.7%analysed9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed

Source: NIST National Vulnerability Database (record CVE-2014-4663), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.