VB
Product
vBulletin
On CISA KEVExploited in the wild
52
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 3Medium 19Low 1
Watch
Add vBulletin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17130 | 6.5 | Oct 4 | vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories Affected: through 5.5.4 |
| CVE-2015-3419 | 6.5 | Sep 19 | vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input… Affected: 5.0.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +17 more |
| CVE-2018-15493 | 6.1 | Oct 17 | vBulletin 5.4.3 has an Open Redirect Affected: 5.4.3 |
| CVE-2018-6200 | 6.1 | Jan 25 | vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter Affected: 3.0.0 through 3.8.11; 4.2.0 through 4.2.5 |
| CVE-2014-9469 | 6.1 | Aug 28 | Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3 Affected: 3.5.4; 3.6; 3.6.7; 3.8.7; 4.2.2; 5.0.5; +1 more |
| CVE-2025-46171 | 5.4 | Jul 23 | vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint Affected: 3.8.7 |
| CVE-2023-39777 | 5.4 | Sep 16 | A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the… Affected: through 6.0.0 |
| CVE-2019-17271 | 4.9 | Oct 8 | vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter Affected: through 5.5.4 |
| CVE-2020-25124 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI Affected: 5.6.3 |
| CVE-2020-25123 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager Affected: 5.6.3 |
| CVE-2020-25122 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager Affected: 5.6.3 |
| CVE-2020-25121 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options Affected: 5.6.3 |
| CVE-2020-25120 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI Affected: 5.6.3 |
| CVE-2020-25119 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual Affected: 5.6.3 |
| CVE-2020-25118 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager Affected: 5.6.3 |
| CVE-2020-25117 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager Affected: 5.6.3 |
| CVE-2020-25116 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager Affected: 5.6.3 |
| CVE-2020-25115 | 4.8 | Sep 3 | The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager Affected: 5.6.3 |
| CVE-2019-17131 | 4.3 | Oct 4 | vBulletin before 5.5.4 allows clickjacking Affected: before 5.5.4 |
Showing 19