What is the CVSS score of CVE-2014-4963?

CVE-2014-4963 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 3.6%.

Is there a public PoC exploit available for CVE-2014-4963?

Yes, a public proof-of-concept exploit is available for CVE-2014-4963. Prioritise patching immediately. EPSS: 3.6%.

Shopizer CVE-2014-4963

MEDIUM

2014-07-15 cve@mitre.org

Information Disclosure Shopizer

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jul 15, 2014 - 14:55 cve.org

MEDIUM 6.8

DescriptionCVE.org

Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action.

AnalysisAI

Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Shopizer

View all

CVE-2022-23063 HIGH This Week POC

8.8 May 03

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. Rated high severity (CVSS 8.8), t

CVE-2014-4962 MEDIUM This Month POC

6.4 Jul 15

Shopizer 1.1.5 and earlier allows remote attackers to reduce the total cost of their shopping cart via a negative number

CVE-2014-4964 MEDIUM This Month POC

6.8 Jul 15

Multiple cross-site request forgery (CSRF) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to hijac

CVE-2022-23061 MEDIUM This Month POC

6.5 May 01

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen acco

CVE-2014-5385 MEDIUM This Month POC

5.0 Aug 21

com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authen

CVE-2014-4965 MEDIUM This Month POC

4.3 Jul 15

Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbit

CVE-2022-23060 MEDIUM This Month POC

4.8 May 01

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged use

CVE-2022-23059 MEDIUM This Month POC

4.8 Mar 29

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images”

CVE-2021-33562 MEDIUM This Month POC

4.8 May 24

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitra

CVE-2021-33561 MEDIUM This Month POC

4.8 May 24

A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary

CVE-2020-11007 MEDIUM This Month

6.5 Apr 16

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated

CVE-2020-11006 MEDIUM This Month

5.4 May 08

In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed wh

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2014-4963 vulnerability details – vuln.today

Back