VB
Product
vBulletin
On CISA KEVExploited in the wild
52
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 3Medium 19Low 1
Watch
Add vBulletin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17496 In wildKEV | 9.8 | Aug 12 | vBulletin PHP Module Remote Code Execution Vulnerability Affected: 5.5.4 through 5.6.2 |
| CVE-2019-16759 In wildKEV | 9.8 | Sep 24 | vBulletin PHP Module Remote Code Execution Vulnerability Affected: 5.0.0 through 5.5.4 |
| CVE-2026-61511 | 9.8 | Jul 27 | vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php Affected: 5.0.0 through 5.7.5; 6.0.0 through 6.2.1 |
| CVE-2025-48827 | 9.8 | May 27 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated… Affected: 5.0.0 through 5.7.5; 6.0.0 through 6.0.3 |
| CVE-2023-25135 | 9.8 | Feb 3 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization Affected: 5.6.7; 5.6.8; 5.6.9 |
| CVE-2020-7373 | 9.8 | Oct 30 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request Affected: 5.5.4 through 5.6.2 |
| CVE-2020-12720 | 9.8 | May 8 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control Affected: 5.0.0 before 5.5.6; 5.5.6; 5.6.0; 5.6.1.- |
| CVE-2019-17132 | 9.8 | Oct 4 | vBulletin through 5.5.4 mishandles custom avatars Affected: through 5.5.4 |
| CVE-2017-17672 | 9.8 | Dec 14 | In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution,… Affected: 5.0.1 through 5.3.3; 5.0.0; 5.0.0 |
| CVE-2017-17671 | 9.8 | Dec 14 | vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal… Affected: 5.0.1 through 5.3.3; 5.0.0; 5.0.0 |
| CVE-2016-6195 | 9.8 | Aug 30 | SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute… Affected: through 4.2.2; 4.2.3 |
Showing 11