CVE-2023-25135

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verifyserialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions a...

CVE-2023-25135

creationtimestamp| type| source ---|---|--- 2023-02-03 07:25:33+00:00| seen| https://t.me/cibsecurity/57440 2023-02-04 17:08:41+00:00| published-proof-of-concept| Telegram/AqbQcSruHnWkutfE8evxRkyLJKRGDqBk7h61RFWxZdE1Lg 2023-02-04 18:01:24+00:00| published-proof-of-concept|...

CVE-2023-25135

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verifyserialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions a...

CVE-2023-25135

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verifyserialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions a...

CVE-2023-25135

CVE-2023-25135: vBulletin before 5.6.9 PL1 has a pre-authentication remote code execution flaw. An unauthenticated attacker can trigger deserialization via a crafted HTTP request because verify_serialized uses unserialize and error checks, enabling arbitrary code execution. Impact is high (remote...