CVE-2025-46171

vBulletin 3.8.7 is vulnerable to a denial-of-service (DoS) condition through the misc.php?do=buddylist endpoint. The root cause is the execution of a large SQL JOIN query that retrieves all friends' information, session data, and online status without any pagination or result limits. When an auth...