CVE-2014-5086

CVE-2014-5086 describes a critical command execution vulnerability in Sphider Pro and Sphider Plus 3.2, stemming from insufficient sanitization of user input written to conf.php. This flaw allows a remote, authenticated attacker to execute arbitrary code on the affected system. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity, leading to high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation or significant community discussion.