CVE-2014-5087: Sphider

Critical severity, CVSS 9.8. EPSS: 7.2% chance of exploitation in the next 30 days.

A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitrary code.

Affected products

• Sphider Sphider: before 1.3.6 (fixed in 1.3.6)
• Sphider-Plus Sphider-Plus: before 3.2 (fixed in 3.2)
• Sphiderpro Sphider Pro: before 3.2 (fixed in 3.2)

Published 2020-02-07. Last modified 2026-06-17.