CVE-2015-1399

CVE-2015-1399 is a remote file inclusion vulnerability in the Mage_Core_Block_Template_Zend class within Magento Community Edition 1.9.1.0 and Enterprise Edition 1.14.1.0. This flaw allows remote administrators to execute arbitrary PHP code by manipulating the setScriptPath function with a malicious URL. With a CVSS score of 6.5, this vulnerability presents a moderate risk, as it requires authentication (Au:S) but has low attack complexity (AC:L), potentially leading to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). Although no public exploit code (Metasploit, Nuclei, ExploitDB) is listed, media coverage indicates it was exploited in the wild shortly after disclosure, garnering significant community discussion.