VB
Product
vBulletin
On CISA KEVExploited in the wild
52
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 3Medium 19Low 1
Watch
Add vBulletin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17496 In wildKEV | 9.8 | Aug 12 | vBulletin PHP Module Remote Code Execution Vulnerability Affected: 5.5.4 through 5.6.2 |
| CVE-2019-16759 In wildKEV | 9.8 | Sep 24 | vBulletin PHP Module Remote Code Execution Vulnerability Affected: 5.0.0 through 5.5.4 |
| CVE-2026-61511 | 9.8 | Jul 27 | vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php Affected: 5.0.0 through 5.7.5; 6.0.0 through 6.2.1 |
| CVE-2025-48827 | 9.8 | May 27 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated… Affected: 5.0.0 through 5.7.5; 6.0.0 through 6.0.3 |
| CVE-2023-25135 | 9.8 | Feb 3 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization Affected: 5.6.7; 5.6.8; 5.6.9 |
| CVE-2020-7373 | 9.8 | Oct 30 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request Affected: 5.5.4 through 5.6.2 |
| CVE-2020-12720 | 9.8 | May 8 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control Affected: 5.0.0 before 5.5.6; 5.5.6; 5.6.0; 5.6.1.- |
| CVE-2019-17132 | 9.8 | Oct 4 | vBulletin through 5.5.4 mishandles custom avatars Affected: through 5.5.4 |
| CVE-2017-17672 | 9.8 | Dec 14 | In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution,… Affected: 5.0.1 through 5.3.3; 5.0.0; 5.0.0 |
| CVE-2017-17671 | 9.8 | Dec 14 | vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal… Affected: 5.0.1 through 5.3.3; 5.0.0; 5.0.0 |
| CVE-2016-6195 | 9.8 | Aug 30 | SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute… Affected: through 4.2.2; 4.2.3 |
| CVE-2017-7569 | 8.6 | Apr 6 | In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037 Affected: through 5.2.6 |
| CVE-2016-6483 | 8.6 | Sep 2 | The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch… Affected: 3.8.7; 3.8.8; 3.8.9; 4.2.2; 4.2.3; 5.2.0; +2 more |
| CVE-2025-48828 | 8.1 | May 27 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine Affected: 6.0.3 |
| CVE-2019-17130 | 6.5 | Oct 4 | vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories Affected: through 5.5.4 |
| CVE-2015-3419 | 6.5 | Sep 19 | vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input… Affected: 5.0.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +17 more |
| CVE-2018-15493 | 6.1 | Oct 17 | vBulletin 5.4.3 has an Open Redirect Affected: 5.4.3 |
| CVE-2018-6200 | 6.1 | Jan 25 | vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter Affected: 3.0.0 through 3.8.11; 4.2.0 through 4.2.5 |
| CVE-2014-9469 | 6.1 | Aug 28 | Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3 Affected: 3.5.4; 3.6; 3.6.7; 3.8.7; 4.2.2; 5.0.5; +1 more |
| CVE-2025-46171 | 5.4 | Jul 23 | vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint Affected: 3.8.7 |
| CVE-2023-39777 | 5.4 | Sep 16 | A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the… Affected: through 6.0.0 |
| CVE-2019-17271 | 4.9 | Oct 8 | vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter Affected: through 5.5.4 |
| CVE-2020-25124 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI Affected: 5.6.3 |
| CVE-2020-25123 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager Affected: 5.6.3 |
| CVE-2020-25122 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager Affected: 5.6.3 |
| CVE-2020-25121 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options Affected: 5.6.3 |
| CVE-2020-25120 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI Affected: 5.6.3 |
| CVE-2020-25119 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual Affected: 5.6.3 |
| CVE-2020-25118 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager Affected: 5.6.3 |
| CVE-2020-25117 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager Affected: 5.6.3 |
| CVE-2020-25116 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager Affected: 5.6.3 |
| CVE-2020-25115 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager Affected: 5.6.3 |
| CVE-2019-17131 | 4.3 | Oct 4 | vBulletin before 5.5.4 allows clickjacking Affected: before 5.5.4 |
| CVE-2026-9357 | 3.5 | May 24 | vBulletin Login cross site scripting Affected: 6.* |
| CVE-2015-7808 | – | Nov 24 | The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; +15 more |
| CVE-2014-9438 | – | Jan 2 | Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for… Affected: 4.2.2 |
| CVE-2014-8670 | – | Nov 6 | Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url… Affected: 4.2.1 |
| CVE-2014-2021 | – | Oct 25 | Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web… Affected: through 4.2.2; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +1 more |
| CVE-2014-2022 | – | Oct 15 | SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL… Affected: through 4.2.2; 4.2.0; 4.2.1 |
| CVE-2014-5102 | – | Jul 25 | SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to… Affected: 5.0.4; 5.0.5; 5.1.0; 5.1.0; 5.1.1; 5.1.2; +4 more |
| CVE-2014-3135 | – | Apr 30 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to… Affected: 5.1.1 |
| CVE-2013-6129 | – | Oct 19 | The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword],… Affected: 4.1; 5.0.0 |
| CVE-2013-3522 | – | May 10 | SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL… Affected: 5.0.0; 5.0.0 |
| CVE-2011-5251 | – | Dec 31 | Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the… Affected: through 4.1.3; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +7 more |
| CVE-2012-4686 | – | Aug 28 | SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter Affected: 4.1.10 |
| CVE-2012-3844 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when… Affected: 4.1.12 |
| CVE-2008-6256 | – | Feb 24 | SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the… Affected: 3.7.3 |
| CVE-2008-6255 | – | Feb 24 | Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) answer parameter to… Affected: 3.7.4 |
| CVE-2008-3773 | – | Aug 22 | Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users… Affected: 3.6.10; 3.7.2 |
| CVE-2008-3184 | – | Jul 15 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web… Affected: 3.6; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; +11 more |