Unscored severity · published Aug 18, 2014
CVE-2014-5266
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document,…
–
CVSS
25.2%
EPSS
No
On KEV
Description
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Exploitation
Is it being used?
Exploit prediction (EPSS)25.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more · source: NVD
WO
WordPress · WordPress
through 3.9.1; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +26 more · source: NVD
DL
Debian Linux · Debian
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5266
cgit.drupalcode.org
http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830
cgit.drupalcode.org
http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
www.debian.org
http://www.debian.org/security/2014/dsa-2999
www.debian.org
http://www.debian.org/security/2014/dsa-3001
core.trac.wordpress.org
https://core.trac.wordpress.org/changeset/29404
Vendor Advisory
https://wordpress.org/news/2014/08/wordpress-3-9-2/
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution