CVE-2014-1999

CVE-2014-1999 describes a remote code execution vulnerability in the auto-format feature of the Request_Curl class within FuelPHP versions 1.1 through 1.7.1. This flaw allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted response to a vulnerable FuelPHP application. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.