{"api_version":"1","generated_at":"2026-07-23T06:18:34+00:00","cve":"CVE-2014-9102","urls":{"html":"https://cve.report/CVE-2014-9102","api":"https://cve.report/api/cve/CVE-2014-9102.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-9102","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-9102"},"summary":{"title":"CVE-2014-9102","description":"Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-11-26 15:59:17","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.kunena.org/blog/139-kunena-3-0-6-released","name":"http://www.kunena.org/blog/139-kunena-3-0-6-released","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Kunena - To Speak! Next Generation Forum Component for Joomla - Kunena 3.0.6 Released","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/68956","name":"http://www.securityfocus.com/bid/68956","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Kunena Multiple SQL Injection and Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.kunena.org/docs/Kunena_3.0.6_Read_Me","name":"http://www.kunena.org/docs/Kunena_3.0.6_Read_Me","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Kunena 3.0.6 Read Me - Kunena Wiki","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html","name":"http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Joomla Kunena Forum 3.0.5 SQL Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9102","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9102","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"9102","vulnerable":"1","versionEndIncluding":"3.0.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kunena","cpe5":"kunena","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"joomla\\!","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:33:13.521Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"68956","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/68956"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.kunena.org/docs/Kunena_3.0.6_Read_Me"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.kunena.org/blog/139-kunena-3-0-6-released"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-11-26T15:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"68956","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/68956"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.kunena.org/docs/Kunena_3.0.6_Read_Me"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.kunena.org/blog/139-kunena-3-0-6-released"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-9102","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"68956","refsource":"BID","url":"http://www.securityfocus.com/bid/68956"},{"name":"http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/127683/Joomla-Kunena-Forum-3.0.5-SQL-Injection.html"},{"name":"http://www.kunena.org/docs/Kunena_3.0.6_Read_Me","refsource":"CONFIRM","url":"http://www.kunena.org/docs/Kunena_3.0.6_Read_Me"},{"name":"http://www.kunena.org/blog/139-kunena-3-0-6-released","refsource":"CONFIRM","url":"http://www.kunena.org/blog/139-kunena-3-0-6-released"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-9102","datePublished":"2014-11-26T15:00:00.000Z","dateReserved":"2014-11-26T00:00:00.000Z","dateUpdated":"2024-09-16T17:58:37.812Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-11-26 15:59:17","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kunena:kunena:*:*:*:*:*:joomla\\!:*:*","versionEndIncluding":"3.0.5","matchCriteriaId":"343C6AFB-9548-439B-8B3A-8E83F6649072"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"9102","Ordinal":"1","Title":"CVE-2014-9102","CVE":"CVE-2014-9102","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"9102","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php.","Type":"Description","Title":"CVE-2014-9102"},{"CveYear":"2014","CveId":"9102","Ordinal":"2","NoteData":"2014-11-26","Type":"Other","Title":"Published"}]}}}