CVE-2014-1632

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.1High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 3 sources FixVendor fixNo build named by the sources

Published 2018-01-31Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Eventum and confirm its installed version is earlier than 2.3.5.
Upgrade Eventum to version 2.3.5 or later.
Until upgraded, restrict access to the Eventum setup page so it cannot be reached by untrusted users.
Ask your IT provider to review the server for unexpected changes to Eventum files or settings.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.

In plain language

Written by AI from the record

Eventum versions before 2.3.5 have a serious flaw that can let an outsider take over the application, so small businesses using it should act promptly.

Unauthenticated remote PHP code injection in Eventum’s setup page allows arbitrary code execution through the hostname parameter.

If you're affected

Full application takeover
Server command execution
Service disruption
Data theft risk

What is it

This is a weakness in Eventum’s installation page that can let someone send harmful instructions to the server. It is like leaving a building’s maintenance control panel accessible from outside, allowing a stranger to change how the building operates.

Who is affected

This matters to you if you run Eventum, especially an installation older than version 2.3.5. An attacker does not need an account or anyone to click anything; it is only a risk if the setup page is reachable by the attacker.

How urgent is it

Public attack code is available, which makes this an amber-level issue that should be addressed promptly. It is not listed in CISA’s catalog of vulnerabilities known to be actively exploited, but an exposed setup page creates a direct route to application takeover.

What to do — in detail

Confirm the deployed Eventum version and determine whether htdocs/setup/index.php is reachable from untrusted networks. Upgrade all affected installations to Eventum 2.3.5 or later; the findings provide one fixed version and do not identify separate maintenance branches or upgrade-breaking changes.

If the upgrade must wait, block external access to the setup page at the web server or network boundary, permitting it only for trusted administrators when genuinely required. Review web-server and Eventum logs for unusual requests to the setup page and inspect Eventum files and configuration for unexpected changes. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2014-1632 is rated CVSS 8.1 High (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue is CWE-275 and permits unauthenticated, network-based arbitrary PHP code injection and execution through the hostname parameter in htdocs/setup/index.php on Eventum versions before 2.3.5. Three public exploits are known. It is not in CISA KEV; EPSS estimates a 10.5% likelihood and reports a falling trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

3 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Real risk signals with little public attention so far.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-22EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

eventum projectoss-project
- eventumOn-premEnterprise Software / collaboration-groupware

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-275No name in the record

Sources

References in the record

And 1 more reference. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Eventum, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account