CVE-2014-2022

Severity CVSS v4.0:
Pending analysis
Type:
CWE-89 SQL Injection
Publication date:
15/10/2014
Last modified:
12/04/2025

Description

SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:* 4.2.2 (including)
cpe:2.3:a:vbulletin:vbulletin:4.2.0:pl2:*:*:*:*:*:*
cpe:2.3:a:vbulletin:vbulletin:4.2.1:*:*:*:*:*:*:*