CVE-2013-2945: b2evolution

Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days.

SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Affected products

• b2evolution b2evolution: up to and including 4.1.6; version 4.1.0 only; version 4.1.1 only; version 4.1.2 only; version 4.1.3 only; version 4.1.4 only; …

Published 2014-04-02. Last modified 2026-06-16.