CVE-2014-9254
CVE-2014-9254 is a high-severity vulnerability in Minibb with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-89.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 1% (67th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-89
- Affected product: Minibb
- Published:
- Last modified:
Description
bb_func_unsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php.
Frequently asked questions
- What is CVE-2014-9254?
- bb_func_unsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php.
- How severe is CVE-2014-9254?
- CVE-2014-9254 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2014-9254 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-9254?
- CVE-2014-9254 affects Minibb. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2014-9254?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2014-9254 published?
- CVE-2014-9254 was published on 2014-12-31 and last updated on 2026-06-17.
References
- http://secunia.com/advisories/61794
- http://security.szurek.pl/minibb-31-blind-sql-injection.html
- http://www.minibb.com/forums/news-9/blind-sql-injection-fix-6430.html
Affected products (1)
- cpe:2.3:a:minibb:minibb:*:*:*:*:*:*:*:*
More vulnerabilities in Minibb
- CVE-2007-3272 — High (CVSS 7.8): Directory traversal vulnerability in index.php in MiniBB 2.0.5 allows remote attackers to read arbitrary files via a ..…
- CVE-2008-2067 — High (CVSS 7.5): SQL injection vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands…
- CVE-2007-5719 — High (CVSS 7.5): SQL injection vulnerability in bb_func_search.php in miniBB 2.1 allows remote attackers to execute arbitrary SQL…
- CVE-2007-2317 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and…
- CVE-2006-5674 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in miniBB 2.0.2 and earlier, when register_globals is enabled, allow…
- CVE-2006-3955 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a allow remote attackers to execute arbitrary PHP…
Other CWE-89 (SQL Injection) vulnerabilities
- CVE-2026-54350 — Critical (CVSS 10.0): Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase…
- CVE-2026-8054 — Critical (CVSS 10.0): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints…
- CVE-2026-42287 — Critical (CVSS 10.0): Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and…
- CVE-2026-3325 — Critical (CVSS 10.0): SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the…
- CVE-2025-10878 — Critical (CVSS 10.0): A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26.…
- CVE-2025-57792 — Critical (CVSS 10.0): Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of…