CVE-2014-7236

CRITICAL

TWiki Debugenableplugins Remote Code Execution

Title source: metasploit

Description

Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/36438
nomisec WORKING POC 10 stars
by m0nad · poc
https://github.com/m0nad/CVE-2014-7236_Exploit
metasploit WORKING POC EXCELLENT
by Netanel Rubin, h0ng10 · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/twiki_debug_plugins.rb

Scores

CVSS v3 9.1
EPSS 0.8423
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-74
Status published
Products (2)
twiki/twiki 6.0
twiki/twiki 4.0 - 4.0.5
Published Feb 17, 2020
Tracked Since Feb 18, 2026