CVE-2014-2022

HIGH 7.1CVE-2014-2022 · Published 15/10/2014 · updated 17/06/2026

In short

CVE-2014-2022 is a HIGH (CVSS 7.1) vulnerability affecting vbulletin (vbulletin).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
vbulletin vbulletin	`= 4.2.0= 4.2.1≤ 4.2.2`	No fix yet

Description

SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.

References

packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html · Exploit
seclists.org/fulldisclosure/2014/Oct/56 · Exploit
securityfocus.com/bid/70417
securitytracker.com/id/1031001
tintinweb/pub · Exploit

More vulnerabilities in vbulletin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

vbulletin

= 4.2.0= 4.2.1≤ 4.2.2

No fix yet

More vulnerabilities in vbulletin

See all →