Ecava IntegraXor Information Exposure
Priority LOW 38CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
Why it matters now
EPSS 0.0265 85th percentileScored 2026-11-07
Fix Fixed IntegraXor (Ecava): 4.1.4410
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ecava | IntegraXor | before 4.1.4410 | 4.1.4410 | Patch available | CNA |
- IntegraXor VendorEcava Affected before 4.1.4410 Fixed in 4.1.4410 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ecava:integraxor:*:*:*:*:*:*:*:* | up to 4.1.4390 | Vulnerable | Ecava |
| cpe:2.3:a:ecava:integraxor:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Ecava |
| cpe:2.3:a:ecava:integraxor:4.1.4340:*:*:*:*:*:*:* | 4.1.4340 | Vulnerable | Ecava |
| cpe:2.3:a:ecava:integraxor:4.1.4360:*:*:*:*:*:*:* | 4.1.4360 | Vulnerable | Ecava |
| cpe:2.3:a:ecava:integraxor:4.1.4369:*:*:*:*:*:*:* | 4.1.4369 | Vulnerable | Ecava |
| cpe:2.3:a:ecava:integraxor:4.1.4380:*:*:*:*:*:*:* | 4.1.4380 | Vulnerable | Ecava |
- cpe:2.3:a:ecava:integraxor:*:*:*:*:*:*:*:* Versions up to 4.1.4390 Vulnerable ·Ecava
- cpe:2.3:a:ecava:integraxor:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Ecava
- cpe:2.3:a:ecava:integraxor:4.1.4340:*:*:*:*:*:*:* Versions 4.1.4340 Vulnerable ·Ecava
- cpe:2.3:a:ecava:integraxor:4.1.4360:*:*:*:*:*:*:* Versions 4.1.4360 Vulnerable ·Ecava
- cpe:2.3:a:ecava:integraxor:4.1.4369:*:*:*:*:*:*:* Versions 4.1.4369 Vulnerable ·Ecava
- cpe:2.3:a:ecava:integraxor:4.1.4380:*:*:*:*:*:*:* Versions 4.1.4380 Vulnerable ·Ecava
Remediation
- Fix · CNA IntegraXor (Ecava) Fixed in 4.1.4410
Timeline
- 2026-10-02 Threatist record created from CVE-2014-0786
- 2026-10-03 Alias added: GHSA-hxvf-rx4m-qx26
References
More Ecava Integraxor vulnerabilities
- TI-2010-04322 Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control… CVSS 2.0HIGH 10.0
- TI-2012-00239 Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor… CVSS 2.0HIGH 9.3
- TI-2017-03960 SQL injection in Ecava IntegraXor CVSS 3.0CRITICAL 9.8
- TI-2012-04006 Multiple buffer overflows in an ActiveX control in PE3DO32A.ocx in IntegraXor SCADA… CVSS 2.0HIGH 9.3
- TI-2016-06854 SQL injection in Ecava IntegraXor 5.0.413.0 CVSS 3.0CRITICAL 9.8
- TI-2010-04323 Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2014-0786 · CVE Program
- CVE-2014-0786 · NVD
- FIRST EPSS
- GHSA-hxvf-rx4m-qx26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences