CVE-2014-9702: 2pisoftware Cmfive

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request.

Affected products

• 2pisoftware Cmfive: up to and including 2015-03-15

Published 2020-06-01. Last modified 2026-06-17.