Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.
https://www.ipa.go.jp/security/ciadr/vul/20140620-jvn.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-3820