40 matches found
EUVD-2017-16574
Malware in sbrugna...
EUVD-2020-17808
Malware in sbrugna...
EUVD-2020-17809
Malware in sbrugna...
EUVD-2019-7588
Malware in sbrugna...
EUVD-2005-0430
Malware in sbrugna...
vBulletin 5.0.x < 6.0.4 Remote Code Execution
vBulletin versions 5.0.x prior to 6.0.4 are vulnerable to an improper authentication allowing unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later. This vulnerability can lead to remote code execution RCE. Note that this plugin requires the 'File...
CVE-2025-48827
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025...
CVE-2025-48828
vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) flaw in the ajax/api/ad/replaceAdTemplate endpoint caused by improper use of PHP’s Reflection API. An unauthenticated attacker can inject a crafted template (eg, using vb:if with code via passthru($POST[...])) and trigge...
CVE-2020-25117
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager...
CVE-2019-17132
vBulletin through 5.5.4 mishandles custom avatars...
CVE-2013-6129
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...
CVE-2011-5251
Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action...
vBulletin 5.x Remote Code Execution
!/bin/bash vBulletin widgettabbedcontainertabpanel 5.x 0day by @Zenofex Usage ./exploit Urlencode cmd CMD=echo $2|perl -MURI::Escape -ne 'chomp;print uriescape$,"\n"' Send request curl -s $1/ajax/render/widgettabbedcontainertabpanel -d...
vBulletin < 5.6.2 Patch Level 1 Remote Code Execution Vulnerability
The instance of vBulletin running on the remote host is affected by a command execution vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to execute commands on the remote host. All versions of vBulletin prior to the 5.6.x branch are...
CVE-2019-17271
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter...
CVE-2019-17131
vBulletin before 5.5.4 allows clickjacking...
CVE-2018-6200
vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter...
Authorization
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...
