[ CVE-2014-125137 · Published 28 Oct 2026 ]
Vulnerability in C97net qEngine CMS
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- www.exploit-db.com/exploits/32504
- www.exploit-db.com/exploits/32508
- www.exploit-db.com/exploits/32511
- www.exploit-db.com/exploits/39129
- www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-…
- www.zeroscience.mk/advisories/ZSL-2014-5173.html
- www.zeroscience.mk/advisories/ZSL-2014-5177.html
- www.zeroscience.mk/advisories/ZSL-2014-5181.html