vBulletin_5.x-tab_panel-RCE

vBulletin5.x-tabpanel-RCE CVE-2020-17496 is a vulnerability in vBulletin’s ajax/render/widgetphp route by injecting malicious code via the widgetConfig parameter. Affected System vBulletin 5.5.4 5.6.2 vBulletin 5.x Widgettabbedcontainertabpanel RCE Vuln Test script Usage python...

vBulletin widget_php RCE (CVE-2019-16759)

Exploits CVE-2019-16759 in vBulletin 5.0.0–5.5.4 via unauthenticated ajax/render/widgettabbedcontainertabpanel widgetphp template injection. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin widgetphp RCE CVE-2019-16759.""" import hashlib import re import urllib.parse from kittysploit import...

vBulletin runMaths Pre-Auth RCE (CVE-2026-61511)

Unauthenticated RCE via vB5TemplateRuntime::runMaths eval injection. Crafted pagenavpagenumber reaches vb:math through ajax/render/pagenav; phpfuck-style encoding bypasses the character whitelist to call system. Affects vBulletin = 6.2.1 / = 6.1.6 and 5.x through 5.7.5. !/usr/bin/env python3 --...

vBulletin runMaths Pre-Auth RCE Detection (CVE-2026-61511)

Detects unauthenticated RCE via vB5TemplateRuntime::runMaths CVE-2026-61511 by sending a safe phpfuck-encoded system'echo …' probe to ajax/render/pagenav. Affects vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 fixed in 6.2.2 / vendor patches. !/usr/bin/env python3 -- coding: utf-8 -- from...

vBulletin 5.0.0-5.5.4 - Remote Command Execution Detection

vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widgetphp routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system...

vBulletin 5.5.4 - 5.6.2- Remote Command Execution Detection

vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin versions 5."""...

CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

PT-2026-64909

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.x through 5.7.5 vBulletin versions 6.x through 6.2.1 Description An eval injection issue exists in the vB5 Template Runtime::runMaths method within the template runtime. This occurs because the method processes expressions...

CVE-2025-47932 Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack...

CVE-2025-47932 Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack...

CVE-2024-51995 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker can request any route we want as long as we specify an operation that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in UI.php to the ajax.render.php page which does not...

iTop IT Service Management Code Execution

The vulnerability of the export-v2.php and ajax.render.php components of the iTop IT service management web tool is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2023-47489

CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components...

Combodo iTop Security Vulnerability

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A security vulnerability exists in Combodo iTop version...

PT-2023-7017

Name of the Vulnerable Software and Affected Versions Combodo iTop version 3.1.0-2-11973 Description The issue is related to a CSV injection in the export as CSV feature, allowing a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components...

CVE-2022-31403

ITOP v3.0.1 was discovered to contain a cross-site scripting XSS vulnerability via /itop/pages/ajax.render.php...

Design/Logic Flaw

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

CVE-2020-7373: Improper Control of Generation of Code

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

PT-2020-19579

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget tabbedcontainer tab panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 ...

CVE-2020-17496: Improper Neutralization of Special Elements in Output Used by a Downstream Component

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759...