VB
Product
vBulletin
On CISA KEVExploited in the wild
52
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 3Medium 19Low 1
Watch
Add vBulletin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7569 | 8.6 | Apr 6 | In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037 Affected: through 5.2.6 |
| CVE-2016-6483 | 8.6 | Sep 2 | The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch… Affected: 3.8.7; 3.8.8; 3.8.9; 4.2.2; 4.2.3; 5.2.0; +2 more |
| CVE-2025-48828 | 8.1 | May 27 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine Affected: 6.0.3 |
Showing 3