CVE-2014-9220
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote...
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
- Record
CVE-2014-9220- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
- Record
CVE-2014-9220- Updated
- 2026-11-02
EUVDEUVD-2014-9045 No score
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
- Record
EUVD-2014-9045- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mpx-36hm-f96q No score
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote...
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
- Record
GHSA-7mpx-36hm-f96q- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVMGASA-2015-0001 No score
Updated openvas-manager packages fix security vulnerability
Updated openvas-manager packages fixes security vulnerability:
It has been identified that OpenVAS Manager before 4.0.6 is vulnerable to sql injections due to a improper handling of the timezone parameter in modify_schedule OMP command. It has been identified that this vulnerability may allow read-access via sql for authorized user account which have permission to modify schedule objects (CVE-2014-9220).
- Record
MGASA-2015-0001- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openvas-managerMageia:4 |
before 4.0.6-1.mga4 | 4.0.6-1.mga4 |
openvas-librariesMageia:4 |
before 6.0.3-1.mga4 | 6.0.3-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9220 is a high vulnerability (CVSS 7.5) in Openvas Manager, published December 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in openvas-manager 4.0.6-1.mga4.