Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-117e-e539-jfgy
Vulnerability ID VCID-117e-e539-jfgy
Aliases CVE-2014-2922
Summary The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00224 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00224 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
epss 0.00224 https://api.first.org/data/v1/epss?cve=CVE-2014-2922
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2014-2922
Data source Exploit-DB
Date added Jan. 25, 2018
Description Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities
Ransomware campaign use Unknown
Source publication date Oct. 12, 2014
Exploit type webapps
Platform hardware
Source update date Jan. 25, 2018
Source URL https://github.com/pedrib/PoC/blob/a2842a650de88c582e963493d5e2711aa4a1b747/advisories/pimcore-2.1.0.txt
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.42353
EPSS Score 0.00203
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T17:43:36.387109+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.0.0