Latest vbulletin vbulletin Vulnerabilities

● CVE-2023-39777

A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.

vBulletin vBulletin<=6.0.0

● CVE-2023-25135

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks th...

vBulletin vBulletin=5.6.7

vBulletin vBulletin=5.6.8

vBulletin vBulletin=5.6.9

WP Engine Better Search Replace=1.4.4

● CVE-2020-7373

vBulletin vBulletin>=5.5.4<=5.6.2

● CVE-2020-25123

The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.

vBulletin vBulletin=5.6.3

● CVE-2020-25124

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.

vBulletin vBulletin=5.6.3

● CVE-2020-25119

The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.

vBulletin vBulletin=5.6.3

● CVE-2020-25118

The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.

vBulletin vBulletin=5.6.3

● CVE-2020-25117

The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.

vBulletin vBulletin=5.6.3

● CVE-2020-25120

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.

vBulletin vBulletin=5.6.3

● CVE-2020-25115

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.

vBulletin vBulletin=5.6.3

● CVE-2020-25116

The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.

vBulletin vBulletin=5.6.3

● CVE-2020-25121

The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.

vBulletin vBulletin=5.6.3

● CVE-2020-25122

The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.

vBulletin vBulletin=5.6.3

● CVE-2020-17496

vBulletin PHP Module Remote Code Execution Vulnerability

vBulletin vBulletin>=5.5.4<=5.6.2

● CVE-2019-17271

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.

vBulletin vBulletin<=5.5.4

● CVE-2019-17131

vBulletin before 5.5.4 allows clickjacking.

vBulletin vBulletin<5.5.4

● CVE-2019-17130

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.

vBulletin vBulletin<=5.5.4

● CVE-2019-17132

vBulletin through 5.5.4 mishandles custom avatars.

vBulletin vBulletin<=5.5.4

● CVE-2019-16759

vBulletin PHP Module Remote Code Execution Vulnerability

vBulletin vBulletin>=5.0.0<=5.5.4

● CVE-2018-15493

vBulletin 5.4.3 has an Open Redirect.

vBulletin vBulletin=5.4.3

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.