CVE-2019-17271

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter...

vBulletin Releases Patch Update for New RCE and SQLi Vulnerabilities

After releasing a patch for a critical zero-day remote code execution vulnerability late last month, vBulletin has recently published a new security patch update that addresses 3 more high-severity vulnerabilities in its forum software. If left unpatched, the reported security vulnerabilities,...

vBulletin SQL Injection Vulnerability (CNVD-2019-38484)

vBulletin is the United States Internet Brands and vBulletin Solutions, Inc. jointly developed an open source commercial Web forum program . vBulletin suffers from an SQL injection vulnerability that can be exploited by attackers to obtain sensitive information...

vBulletin 5.5.4 Remote Code Execution

--------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability --------------------------------------------------------------------- - Software Link: https://www.vbulletin.com/ - Affected Versions: Version 5.5.4 and prior...

vBulletin CVE-2019-17271 Multiple SQL Injection Vulnerabilities

Description vbulletin is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. An attacker can leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

vBulletin 5.5.4 SQL Injection

---------------------------------------------------- vBulletin = 5.5.4 Two SQL Injection Vulnerabilities ---------------------------------------------------- - Software Link: https://www.vbulletin.com/ - Affected Versions: Version 5.5.4 and prior versions. - Vulnerabilities Description: 1 User...

vBulletin CVE-2019-17132 Remote Code Execution Vulnerability

Description vBulletin is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition. vBulletin versions 5.5.4 and prior are...

vBulletin 5.0 5.5.4 - updateAvatar Authenticated Remote Code Execution

vBulletin 5.0 5.5.4 - updateAvatar Authenticated Remote Code Execution ?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability ---------------------------------------------------------------------...

vBulletin 5.0 < 5.5.4 - (updateAvatar) Authenticated Remote Code Execution Exploit

Exploit for php platform in category web applications ?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability --------------------------------------------------------------------- author..............: Egidio...

vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution

?php / --------------------------------------------------------------------- vBulletin = 5.5.4 updateAvatar Remote Code Execution Vulnerability --------------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail................:...

CVE-2019-17130

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories...

CVE-2019-17131

vBulletin before 5.5.4 allows clickjacking...

CVE-2019-17132

vBulletin through 5.5.4 mishandles custom avatars...

CVE-2019-17130

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories...

CVE-2019-17131

vBulletin before 5.5.4 allows clickjacking...

CVE-2019-17132

vBulletin through 5.5.4 mishandles custom avatars...

Code injection

vBulletin through 5.5.4 mishandles custom avatars...

Security feature bypass

vBulletin before 5.5.4 allows clickjacking...

Design/Logic Flaw

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories...

CVE-2019-17132

CVE-2019-17132 affects vBulletin 5.5.4 and earlier, with a remote code execution via the updateAvatar endpoint from data[extension]/data[filedata] parameters. Several sources document an RCE vulnerability and PoCs/exploits exist; authenticated access is shown in some materials. Impact is high (RC...