Auth bypass in Simple E-Document

CVE-2014-125126

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise.

Vulnerability class: Broken Authentication

Published · last modified .

EPSS exploit prediction

EPSS: 0.017 (76.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2014-125126: rose from 0.012 to 0.017.

EPSS over last 30 days · oldest: 0.012 · newest: 0.017 · change: +0.005

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2014-125126?
CVE-2014-125126 is a vulnerability in Simple E-Document, classified under Missing Authentication for Critical Function. Published 2025-07-31.
Is CVE-2014-125126 known to be exploited?
3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.