Vulnerabilities

TI-2026-44086 CVE-2026-61511 · GHSA-43hg-f3wj-j2m6

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

HIGH 81

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execut…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.05607 Published 2026-07-27 Fixed in 6.2.2 CWE-95

TI-2025-28955 CVE-2025-46171 · GHSA-q9rx-45gj-g3f5

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the…

MEDIUM 58

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00306 Published 2025-07-23 No fix listed CWE-400

TI-2025-31015 CVE-2025-48828 · GHSA-58pj-rcxg-3vhg

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing…

HIGH 74

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.57297 Published 2025-05-27 No fix listed CWE-424

TI-2025-31014 CVE-2025-48827 · GHSA-23fp-mrfv-cwv4

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to…

CRITICAL 88

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pat…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.75638 Published 2025-05-27 No fix listed CWE-424

TI-2023-20779 CVE-2023-39777 · GHSA-8mfq-mqv3-25m4

A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00446 Published 2023-09-16 No fix listed CWE-79

TI-2023-10600 CVE-2023-25135 · GHSA-r8jw-f89q-p7g6

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary…

HIGH 82

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.23926 Published 2023-02-03 No fix listed CWE-502

TI-2020-05959 CVE-2020-7373 · GHSA-mvwh-2m72-5jm7

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data…

HIGH 71

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.45007 Published 2020-10-30 No fix listed CWE-94

TI-2020-15361 CVE-2020-25115 · GHSA-qh2p-m2fc-fmj6

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15362 CVE-2020-25116 · GHSA-475x-m5p2-cpmx

The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15363 CVE-2020-25117 · GHSA-x555-xfrf-8fmq

The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15364 CVE-2020-25118 · GHSA-w4pg-9q6g-g488

The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15365 CVE-2020-25119 · GHSA-m9qm-wg4v-rppg

The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00663 Published 2020-09-03 No fix listed CWE-79

TI-2020-15366 CVE-2020-25120 · GHSA-3536-4v83-8gqw

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15367 CVE-2020-25121 · GHSA-vx2g-r3ch-4r2c

The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00669 Published 2020-09-03 No fix listed CWE-79

TI-2020-15368 CVE-2020-25122 · GHSA-mpf4-wfjf-qhgf

The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15369 CVE-2020-25123 · GHSA-vr39-mjvp-qmg3

The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-15370 CVE-2020-25124 · GHSA-gcqv-qxrf-w8gq

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.

LOW 23

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00553 Published 2020-09-03 No fix listed CWE-79

TI-2020-13248 CVE-2020-17496 · GHSA-j77p-6wx9-cjqq

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data…

CRITICAL 100KEV

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87478 Published 2020-08-12 No fix listed CWE-74

TI-2020-10114 CVE-2020-12720 · GHSA-rgcf-v2qh-fw5r

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

HIGH 84

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.88948 Published 2020-05-07 No fix listed CWE-306

TI-2019-12886 CVE-2019-17271 · GHSA-294x-vx6v-6x6f

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.

LOW 25

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01447 Published 2019-10-08 No fix listed CWE-89

TI-2019-12783 CVE-2019-17132 · GHSA-x269-c5mf-x3rj

vBulletin through 5.5.4 mishandles custom avatars.

MEDIUM 56

vBulletin through 5.5.4 mishandles custom avatars.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11832 Published 2019-10-04 No fix listed CWE-20

TI-2019-12782 CVE-2019-17131 · GHSA-2hr5-6qwp-r4jj

vBulletin before 5.5.4 allows clickjacking.

LOW 22

vBulletin before 5.5.4 allows clickjacking.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00837 Published 2019-10-04 No fix listed CWE-1021

TI-2019-12781 CVE-2019-17130 · GHSA-qmv5-vrr2-gw98

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.

LOW 31

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00964 Published 2019-10-04 No fix listed CWE-552

TI-2019-12540 CVE-2019-16759 · GHSA-c7wq-5768-48mp

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code]…

CRITICAL 100KEV

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99728 Published 2019-09-24 No fix listed CWE-94

TI-2018-11049 CVE-2018-15493 · GHSA-966f-g46g-crjp

vBulletin 5.4.3 has an Open Redirect.

LOW 28

vBulletin 5.4.3 has an Open Redirect.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00655 Published 2018-10-17 No fix listed CWE-601

Vulnerabilities

Filters