CVE-2014-9450

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/61554
http://www.zabbix.com/rn1.8.22.phpVendor Advisory
http://www.zabbix.com/rn2.0.14.phpVendor Advisory
http://www.zabbix.com/rn2.2.8.phpVendor Advisory
https://support.zabbix.com/browse/ZBX-8582Vendor Advisory
http://secunia.com/advisories/61554
http://www.zabbix.com/rn1.8.22.phpVendor Advisory
http://www.zabbix.com/rn2.0.14.phpVendor Advisory
http://www.zabbix.com/rn2.2.8.phpVendor Advisory
https://support.zabbix.com/browse/ZBX-8582Vendor Advisory

Timeline

Published: Jan 2, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-94517.5Multiple stack-based buffer overflows in the DIVA web service API (/webservice) in VDG Security SENSE (formerly DIVA) 2.3.13 allow remote at CVE-2014-94525.0Directory traversal vulnerability in VDG Security SENSE (formerly DIVA) 2.3.13 allows remote attackers to read arbitrary files via a .. (dot CVE-2014-94534.3Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote CVE-2014-94546.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attack CVE-2014-94557.5SQL injection vulnerability in showads.php in CTS Projects & Software ClassAd 3.0 allows remote attackers to execute arbitrary SQL commands CVE-2014-945610.0Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XM CVE-2014-94576.5SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrar CVE-2014-945810.0Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to CVE-2014-94596.8Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attac CVE-2014-94606.8Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hi CVE-2014-94613.5Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated user CVE-2014-94627.5The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted reposito