UnratedFix available
zabbix — security advisory
Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.
- Products
- zabbix
- Affected versions
- Not specified
- Fixed versions
- 1:2.2.7+dfsg-2
- CVEs
- CVE-2014-9450
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:37 UTC · Revision 1
Source evidence
Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.
osv:DEBIAN-CVE-2014-9450
zabbix
Fixed versions: 1:2.2.7+dfsg-2
zabbix
Fixed versions: 1:2.2.7+dfsg-2
zabbix
Fixed versions: 1:2.2.7+dfsg-2
Complete source record
{
"id": "b1dbac6c3fae65d2533857a8e407f7ff2d3fb632675a041958872c8f3e6dec05",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2014-9450",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2014-9450",
"summary": "Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.",
"evidence": "osv:DEBIAN-CVE-2014-9450",
"products": [
{
"name": {
"value": "zabbix",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:2.2.7+dfsg-2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "zabbix",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:2.2.7+dfsg-2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "zabbix",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:2.2.7+dfsg-2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2014-9450",
"aliases": [
"DEBIAN-CVE-2014-9450"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:2.2.7+dfsg-2"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-9450.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:2.2.7+dfsg-2"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-9450.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:2.2.7+dfsg-2"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-9450.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T15:47:25.492097709Z",
"provider": "osv",
"upstream": [
"CVE-2014-9450"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2014-9450"
]
},
"related_cves": [
{
"value": "CVE-2014-9450",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 413844,
"published_at": "2015-01-02T20:59:09.71+00:00"
}