CVE-2014-5249: SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6...

Security readout for executives and security teams

CVE-2014-5249 is a SQL injection flaw in the Biblio self autocomplete submodule of Drupal Biblio Autocomplete. A remote attacker could make the site execute arbitrary database commands. The sources do not provide a CVSS score or active exploitation evidence, but exposed affected sites should treat this as serious. Exposure is likely limited to Drupal 6 or Drupal 7 sites with the contributed Biblio Autocomplete module installed, especially where the Biblio self autocomplete submodule is enabled and reachable by remote users. Prioritize remediation on internet-facing Drupal sites that use Biblio Autocomplete. Although public scoring and exploit evidence are missing, SQL injection can threaten data confidentiality, integrity, and site control. Mitigation focus: Upgrade Biblio Autocomplete to 6.x-1.1 or later for Drupal 6.; Upgrade Biblio Autocomplete to 7.x-1.5 or later for Drupal 7.; Disable the Biblio self autocomplete submodule if upgrade is not immediately possible..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.