Lynne is correct. Your clauses are out of order. In addition, I would add that the query you provided is extremely vulnerable to SQL injection attacks--and DB errors if an ID isn't passed. You should consider using vbulletin's internal functions for fetching passed parameters. Example:
PHP Code:
// Additionally using intval, because I am not 100% sure var is set to 0 by vbulletin if no parameter was passed.
$myID = intval($vbulletin->input->clean_gpc('g', 'id', TYPE_INT));
$featured = $db->query_read("
SELECT title2,picture2,catid2
FROM " . TABLE_PREFIX . "tabeladva
where number = $myID
ORDER BY views2 desc
LIMIT 5"
);