Unscored severity · published Oct 15, 2014
CVE-2014-2022
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL…
–
CVSS
2.7%
EPSS
No
On KEV
Description
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VB
Vbulletin · Vbulletin
through 4.2.2; 4.2.0; 4.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2022
Exploit
http://packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Oct/56
www.securityfocus.com
http://www.securityfocus.com/bid/70417
www.securitytracker.com
http://www.securitytracker.com/id/1031001
Exploit
https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022
More from Vbulletin
9.8
CVE-2020-17496
vBulletin PHP Module Remote Code Execution Vulnerability
9.8
CVE-2019-16759
vBulletin PHP Module Remote Code Execution Vulnerability
9.8
CVE-2026-61511
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
9.8
CVE-2025-48827
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated…
9.8
CVE-2023-25135
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization