VB
Product
Vbulletin
51
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Vbulletin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2007-4453 | – | Aug 21 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the… Affected: 3.6.8 |
| CVE-2007-4120 | – | Aug 1 | Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to… Affected: 3.6.5 |
| CVE-2007-3326 | – | Jun 21 | Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a Affected: 3.0.0 |
| CVE-2007-2910 | – | May 30 | Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to… Affected: through 3.6.6 |
| CVE-2007-2908 | – | May 30 | Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a… Affected: through 3.6.5 |
| CVE-2007-2909 | – | May 30 | Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 3.6.6 |
| CVE-2007-2912 | – | May 30 | Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag"… Affected: through 3.6.4 |
| CVE-2007-2911 | – | May 30 | SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the… Affected: through 3.6.5 |
| CVE-2007-1573 | – | Mar 21 | SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached… Affected: through 3.6.5; 3.6.4 |
| CVE-2007-1342 | – | Mar 8 | Cross-site scripting (XSS) vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss… Affected: through 3.6.5 |
| CVE-2007-1292 | – | Mar 7 | SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary… Affected: through 3.5.8; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; +1 more |
| CVE-2007-0869 | – | Feb 9 | Cross-site scripting (XSS) vulnerability in the Attachment Manager (admincp/attachment.php) in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or… Affected: 3.6.4 |
| CVE-2007-0830 | – | Feb 7 | Multiple cross-site scripting (XSS) vulnerabilities in the Admin Control Panel (AdminCP) in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary… Affected: 3.6.4 |
| CVE-2006-6779 | – | Dec 28 | Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger… Affected: 3.5.1; 3.5.2; 3.5.4; 3.6.0; 3.6.1; 3.6.2; +2 more |
| CVE-2006-6040 | – | Nov 22 | Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs… Affected: 3.6.0; 3.6.1; 3.6.2; 3.6.3 |
| CVE-2006-5104 | – | Oct 3 | SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter Affected: 2.3.0; 2.3.2; 2.3.3; 2.3.4; 2.3.8 |
| CVE-2006-4272 | – | Aug 21 | Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to… Affected: 3.5.4 |
| CVE-2006-4273 | – | Aug 21 | Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf… Affected: 3.5.4; 3.6.0 |
| CVE-2006-4271 | – | Aug 21 | PHP remote file inclusion vulnerability in install/upgrade_301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter Affected: 3.5.4 |
| CVE-2006-3253 | – | Jun 28 | Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter Affected: 3.5.0; 3.5.0_beta_1; 3.5.0_beta_2; 3.5.0_beta_3; 3.5.0_beta_4; 3.5.0_rc1; +5 more |
| CVE-2006-2805 | – | Jun 3 | SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter Affected: 3.0.10 |
| CVE-2006-2335 | – | May 12 | Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a… Affected: 3.5.8 |
| CVE-2006-2018 | – | Apr 25 | SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter Affected: 3.0; 3.0.0; 3.0.0_beta_2; 3.0.0_can4; 3.0.0_rc4; 3.0.1; +7 more |
| CVE-2006-1816 | – | Apr 18 | PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1)… Affected: 3.5.1; 3.5.2; 3.5.4 |
| CVE-2006-1040 | – | Mar 7 | Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in… Affected: 3.0.12; 3.5.3 |
| CVE-2006-0080 | – | Jan 4 | Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an… Affected: 3.5.2 |
| CVE-2005-4621 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +32 more |
| CVE-2005-3025 | – | Sep 21 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1)… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +27 more |
| CVE-2005-3024 | – | Sep 21 | Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +27 more |
| CVE-2005-3023 | – | Sep 21 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1)… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +29 more |
| CVE-2005-3022 | – | Sep 21 | Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +29 more |
| CVE-2005-3021 | – | Sep 21 | image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +29 more |
| CVE-2005-3019 | – | Sep 21 | Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2)… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +28 more |
| CVE-2005-3020 | – | Sep 21 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php,… Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +29 more |
| CVE-2005-0429 | – | May 2 | Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attackers to execute inject arbitrary PHP… Affected: 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4 |
| CVE-2005-0511 | – | Feb 21 | misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the… Affected: 2.0; 2.0.1; 2.0.2; 2.0_beta_2; 2.0_beta_3; 2.2.0; +23 more |
| CVE-2004-1823 | – | Dec 31 | Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbitrary web script or HTML via the (1)… Affected: 3.0.0; 3.0.0_can4 |
| CVE-2004-2695 | – | Dec 31 | SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary… Affected: 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0_beta_2; 3.0_beta_3; +5 more |
| CVE-2004-2288 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in index.php in Jelsoft vBulletin allows remote attackers to spoof parts of a website via the loc parameter Affected: 1.0.1; 2.0.3; 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; +19 more |
| CVE-2004-2076 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter Affected: 3.0.0_rc4 |
| CVE-2004-1515 | – | Dec 31 | SQL injection vulnerability in (1) ttlast.php and (2) last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as… Affected: 3.0.0; 3.0.0_beta_2; 3.0.0_can4; 3.0.0_rc4; 3.0.1; 3.0.2; +5 more |
| CVE-2004-0620 | – | Dec 6 | Cross-site scripting (XSS) vulnerability in (1) newreply.php or (2) newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script as other users via… Affected: 3.0.1 |
| CVE-2004-0091 | – | Feb 17 | NOTE: this issue has been disputed by the vendor Affected: 3.0_beta_2 |
| CVE-2004-0036 | – | Jan 20 | SQL injection vulnerability in calendar.php for vBulletin Forum 2.3.x before 2.3.4 allows remote attackers to steal sensitive information via the eventid parameter Affected: 2.3.0 |
| CVE-2003-0295 | – | Jun 16 | Cross-site scripting (XSS) vulnerability in private.php for vBulletin 3.0.0 Beta 2 allows remote attackers to inject arbitrary web script and HTML via the "Preview Message"… Affected: 3.0.0_beta_2 |
| CVE-2002-1660 | – | Dec 31 | calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter Affected: through 2.1.9 |
| CVE-2002-2235 | – | Dec 31 | member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user… Affected: 2.0; 2.0.1; 2.0.2; 2.2.0; 2.2.1; 2.2.2; +8 more |
| CVE-2002-1922 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in global.php in Jelsoft vBulletin 2.0.0 through 2.2.8 allows remote attackers to inject arbitrary web script or HTML via the (1)… Affected: 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; 2.2.2; 2.2.3; +5 more |
| CVE-2002-1679 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 2.2.0 allows remote attackers to execute arbitrary script as other users by injecting script into a bulletin board… Affected: 2.2.0 |
| CVE-2002-1678 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in memberlist.php in Jelsoft vBulletin 2.0 rc 2 through 2.2.4 allows remote attackers to steal authentication credentials by injecting… Affected: 2.0_rc2; 2.0_rc3; 2.2.0; 2.2.1; 2.2.2; 2.2.3; +1 more |