Vbulletin vulnerabilities

Products

• Vbulletin 52

Newest

• vbulletin vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php CVE-2026-61511 Public exploit 9.3 CriticalJuly 27, 2026
• vbulletin vBulletin Login cross site scripting CVE-2026-9357 5.1 MediumMay 24, 2026
• vbulletin vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist... CVE-2025-46171 Public exploit 5.4 MediumJuly 23, 2025
• vbulletin Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing... CVE-2025-48828 Public exploit EPSS 57.3% 9.0 CriticalMay 27, 2025
• vbulletin vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke... CVE-2025-48827 Public exploit EPSS 75.6% 10.0 CriticalMay 27, 2025
• vbulletin A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0... CVE-2023-39777 5.4 MediumSeptember 16, 2023
• vbulletin vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code... CVE-2023-25135 EPSS 23.9% 9.8 CriticalFebruary 3, 2023
• vbulletin vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an... CVE-2020-7373 EPSS 45.0% 9.8 CriticalOctober 30, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile... CVE-2020-25115 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager. CVE-2020-25116 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager. CVE-2020-25117 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager. CVE-2020-25118 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff... CVE-2020-25119 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI. CVE-2020-25120 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in... CVE-2020-25121 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager. CVE-2020-25122 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager. CVE-2020-25123 4.8 MediumSeptember 3, 2020
• vbulletin The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI. CVE-2020-25124 4.8 MediumSeptember 3, 2020
• vbulletin vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an... CVE-2020-17496 In KEVPublic exploit EPSS 87.5% 9.8 CriticalAugust 12, 2020
• vbulletin vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access... CVE-2020-12720 Public exploit EPSS 88.9% 9.8 CriticalMay 7, 2020
• vbulletin vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget... CVE-2019-17271 4.9 MediumOctober 8, 2019
• vbulletin vBulletin through 5.5.4 mishandles custom avatars. CVE-2019-17132 Public exploit EPSS 11.8% 9.8 CriticalOctober 4, 2019
• vbulletin vBulletin before 5.5.4 allows clickjacking. CVE-2019-17131 4.3 MediumOctober 4, 2019
• vbulletin vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core... CVE-2019-17130 6.5 MediumOctober 4, 2019
• vbulletin vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter... CVE-2019-16759 In KEVPublic exploit EPSS 99.7% 9.8 CriticalSeptember 24, 2019
• vbulletin vBulletin 5.4.3 has an Open Redirect. CVE-2018-15493 6.1 MediumOctober 17, 2018
• vbulletin vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter. CVE-2018-6200 6.1 MediumJanuary 25, 2018
• vbulletin In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads... CVE-2017-17672 Public exploit EPSS 15.2% 9.8 CriticalDecember 14, 2017
• vbulletin vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call... CVE-2017-17671 9.8 CriticalDecember 14, 2017
• vbulletin vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and... CVE-2015-3419 6.5 MediumSeptember 19, 2017
• vbulletin Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5,... CVE-2014-9469 6.1 MediumAugust 28, 2017
• vbulletin In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF... CVE-2017-7569 8.6 HighApril 6, 2017
• vbulletin The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2... CVE-2016-6483 Public exploit EPSS 12.9% 8.6 HighSeptember 2, 2016
• vbulletin SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2... CVE-2016-6195 Public exploit EPSS 70.9% 9.8 CriticalAugust 30, 2016
• vbulletin The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote... CVE-2015-7808 Public exploit EPSS 80.6% 7.5 HighNovember 24, 2015
• vbulletin Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2... CVE-2014-9438 6.8 MediumJanuary 2, 2015
• vbulletin Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect... CVE-2014-8670 5.8 MediumNovember 6, 2014
• vbulletin Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier,... CVE-2014-2021 Public exploit 3.5 LowOctober 25, 2014
• vbulletin SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4... CVE-2014-2022 Public exploit 7.1 HighOctober 15, 2014
• vbulletin SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to... CVE-2014-5102 7.5 HighJuly 25, 2014
• vbulletin Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote... CVE-2014-3135 4.3 MediumApril 30, 2014
• vbulletin The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create... CVE-2013-6129 Public exploit EPSS 51.9% 7.5 HighOctober 19, 2013
• vbulletin SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0... CVE-2013-3522 Public exploit EPSS 27.1% 6.5 MediumMay 10, 2013
• vbulletin Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote... CVE-2011-5251 5.8 MediumDecember 31, 2012
• vbulletin SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to... CVE-2012-4686 Public exploit 7.5 HighAugust 28, 2012
• vbulletin mapi, forum, suite +2 more Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2... CVE-2012-4328 10.0 HighAugust 14, 2012
• vbulletin Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject... CVE-2012-3844 4.3 MediumJuly 3, 2012
• vbulletin SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote... CVE-2008-6256 6.5 MediumFebruary 24, 2009
• vbulletin Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated... CVE-2008-6255 6.5 MediumFebruary 24, 2009
• vbulletin vbgooglemap SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows... CVE-2008-4706 Public exploit 7.5 HighOctober 23, 2008
• Show olderLoading…