CVE-2014-2021

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-25 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

Affected products

vBulletin: through 4.2.2; 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5

References

http://packetstormsecurity.com/files/128691/vBulletin-5.x-4.x-Persistent-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2014/Oct/55
http://seclists.org/fulldisclosure/2014/Oct/63
http://www.securityfocus.com/bid/70577
http://www.securitytracker.com/id/1031000
https://exchange.xforce.ibmcloud.com/vulnerabilities/97026
https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2021
http://packetstormsecurity.com/files/128691/vBulletin-5.x-4.x-Persistent-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2014/Oct/55
http://seclists.org/fulldisclosure/2014/Oct/63
http://www.securityfocus.com/bid/70577
http://www.securitytracker.com/id/1031000

Get alerted when CVE-2014-2021 or the next vulnerability affects your stack