Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2014-9057: Movable Type XML-RPC allows attackers to run database commands
CVE-2014-9057 · published 11 years ago
Summary
The XML-RPC feature in Movable Type versions earlier than 5.18, 5.2.11, and 6.0.6 can be tricked into sending harmful database queries. An attacker who can reach this interface could read, change, or delete data stored by the software. Upgrade Movable Type (or the Debian package that contains it) to the latest released version to close the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debian | debian_linux |
7.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| sixapart | movable_type |
<= 5.17 5.2 5.2.2 5.2.3 5.2.4 5.2.5 5.2.6 5.2.7 5.2.8 5.2.9 5.2.10 6.0 5 more version ranges
cpe:2.3:a:sixapart:movable_type:*:*:*:*:*:*:*:* |
Original advisory text
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified...
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-89SQL Injection
Timeline
Published16 Dec 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-9057 · NVD
Track software like this
Free during beta