{"id":"CVE-2019-16759","aliases":["EUVD-2019-7294","GHSA-c7wq-5768-48mp"],"status":"published","title":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter...","description":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99728,"percentile":0.99952,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-94"],"published":"2019-09-24T21:01:49Z","modified":"2026-06-17T02:22:44Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"exploitdb","id":"EDB-47447","title":"vBulletin 5.0 \u003c 5.5.4 - 'widget_php ' Unauthenticated Remote Code Execution","type":"webapps","platform":"php","date":"2019-09-23","url":"https://www.exploit-db.com/exploits/47447"},{"source":"metasploit","id":"exploit/multi/http/vbulletin_widgetconfig_rce","title":"vBulletin widgetConfig RCE","type":"exploit","platform":"PHP,Unix,Windows","date":"2019-09-23","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/vbulletin_widgetconfig_rce"},{"source":"pocgithub","id":"M0sterHxck/CVE-2019-16759-Vbulletin-rce-exploit","title":"M0sterHxck/CVE-2019-16759-Vbulletin-rce-exploit","date":"2019-09-25","url":"https://github.com/M0sterHxck/CVE-2019-16759-Vbulletin-rce-exploit"},{"source":"pocgithub","id":"jas502n/CVE-2019-16759","title":"jas502n/CVE-2019-16759","date":"2019-09-26","url":"https://github.com/jas502n/CVE-2019-16759"},{"source":"pocgithub","id":"r00tpgp/http-vuln-CVE-2019-16759","title":"r00tpgp/http-vuln-CVE-2019-16759","date":"2019-09-26","url":"https://github.com/r00tpgp/http-vuln-CVE-2019-16759"},{"source":"exploitdb","id":"EDB-47437","title":"vBulletin 5.x - Remote Command Execution (Metasploit)","type":"webapps","platform":"php","date":"2019-09-30","url":"https://www.exploit-db.com/exploits/47437"},{"source":"pocgithub","id":"theLSA/vbulletin5-rce","title":"theLSA/vbulletin5-rce","date":"2019-10-02","url":"https://github.com/theLSA/vbulletin5-rce"},{"source":"pocgithub","id":"FarjaalAhmad/CVE-2019-16759","title":"FarjaalAhmad/CVE-2019-16759","date":"2019-10-12","url":"https://github.com/FarjaalAhmad/CVE-2019-16759"},{"source":"pocgithub","id":"andripwn/pwn-vbulletin","title":"andripwn/pwn-vbulletin","date":"2019-12-29","url":"https://github.com/andripwn/pwn-vbulletin"},{"source":"pocgithub","id":"psychoxploit/vbull","title":"psychoxploit/vbull","date":"2020-02-20","url":"https://github.com/psychoxploit/vbull"},{"source":"pocgithub","id":"polar1s7/CVE-2019-16759-bypass","title":"polar1s7/CVE-2019-16759-bypass","date":"2020-08-12","url":"https://github.com/polar1s7/CVE-2019-16759-bypass"},{"source":"pocgithub","id":"nako48/CVE-2019-16759","title":"nako48/CVE-2019-16759","date":"2020-08-13","url":"https://github.com/nako48/CVE-2019-16759"},{"source":"pocgithub","id":"0xdims/CVE-2019-16759","title":"0xdims/CVE-2019-16759","date":"2020-08-16","url":"https://github.com/0xdims/CVE-2019-16759"},{"source":"pocgithub","id":"ludy-dev/vBulletin_Routestring-RCE","title":"ludy-dev/vBulletin_Routestring-RCE","date":"2020-08-31","url":"https://github.com/ludy-dev/vBulletin_Routestring-RCE"},{"source":"pocgithub","id":"fxp0-4tx/CVE-2019-16759","title":"fxp0-4tx/CVE-2019-16759","date":"2020-11-29","url":"https://github.com/fxp0-4tx/CVE-2019-16759"},{"source":"pocgithub","id":"shavchen/CVE-2019-16759","title":"shavchen/CVE-2019-16759","date":"2022-02-17","url":"https://github.com/shavchen/CVE-2019-16759"},{"source":"nuclei","id":"CVE-2019-16759","title":"vBulletin 5.0.0-5.5.4 - Remote Command Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16759.yaml"}],"products":[{"vendor":"vbulletin","product":"vbulletin"}],"references":[{"url":"https://seclists.org/fulldisclosure/2019/Sep/31","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/","tags":["x_refsource_MISC","x_transferred","Press/Media Coverage","Third Party Advisory"]},{"url":"https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/","tags":["x_refsource_MISC","x_transferred","Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Aug/5","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16759"},{"url":"https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug"},{"url":"https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday"},{"url":"https://github.com/advisories/GHSA-c7wq-5768-48mp"}],"sources":{"cve":[{"id":"CVE-2019-16759","description":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","status":"published","published":"2019-09-24T21:01:49Z","modified":"2025-10-21T23:45:30.09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-7294","description":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","status":"published","published":"2019-09-24T21:01:49Z","modified":"2025-10-21T23:45:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-c7wq-5768-48mp","title":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter...","description":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","status":"published","published":"2022-05-24T22:00:43Z","modified":"2025-10-22T00:32:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2019-16759","title":"vBulletin PHP Module Remote Code Execution Vulnerability","description":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","cwes":["CWE-94"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2019-16759","description":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","status":"published","published":"2019-09-24T22:15:13.183Z","modified":"2026-06-17T02:22:44.363Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:05:28.126831Z"}]}}