Login Request a demo
VB
Vendor
vBulletin
5 products with CVEs on record
56
CVEs
2
On KEV
0
New 30D
Products
VB
vBulletin
vBulletin
9.8
52 CVEs2 on KEV0 new
MA
Mapi
Vbulletin
–
1 CVEs0 on KEV0 new
VB
Vbgooglemap
Vbulletin
–
1 CVEs0 on KEV0 new
VF
Vbulletin Forum
Vbulletin
–
1 CVEs0 on KEV0 new
VS
Vbulletin Suite
Vbulletin
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-61511
VB
vBulletin
vBulletin
9.8
6%
Jul 27vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
CVE-2026-9357
VB
vBulletin
Vbulletin
3.5
0%
May 24vBulletin Login cross site scripting
CVE-2025-46171
VB
Vbulletin
Vbulletin
5.4
0%
Jul 23vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint
CVE-2025-48828
VB
vBulletin
vBulletin
8.1
57%
May 27Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine
CVE-2025-48827
VB
vBulletin
vBulletin
9.8
76%
May 27vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated…
CVE-2023-39777
VB
Vbulletin
Vbulletin
5.4
0%
Sep 16A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the…
CVE-2023-25135
VB
Vbulletin
Vbulletin
9.8
24%
Feb 3vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization
CVE-2020-7373
VB
Vbulletin
Vbulletin
9.8
45%
Oct 30vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request
CVE-2020-25124
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI
CVE-2020-25123
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager
CVE-2020-25122
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager
CVE-2020-25121
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options
CVE-2020-25120
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI
CVE-2020-25119
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual
CVE-2020-25118
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager
CVE-2020-25117
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager
CVE-2020-25116
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager
CVE-2020-25115
VB
Vbulletin
Vbulletin
4.8
1%
Sep 3The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager
CVE-2020-17496
In wildKEV
VB
Vbulletin
Vbulletin
9.8
87%
Aug 12vBulletin PHP Module Remote Code Execution Vulnerability
CVE-2020-12720
VB
Vbulletin
Vbulletin
9.8
89%
May 8vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control
CVE-2019-17271
VB
Vbulletin
Vbulletin
4.9
1%
Oct 8vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter
CVE-2019-17132
VB
Vbulletin
Vbulletin
9.8
12%
Oct 4vBulletin through 5.5.4 mishandles custom avatars
CVE-2019-17131
VB
Vbulletin
Vbulletin
4.3
1%
Oct 4vBulletin before 5.5.4 allows clickjacking
CVE-2019-17130
VB
Vbulletin
Vbulletin
6.5
1%
Oct 4vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories
CVE-2019-16759
In wildKEV
VB
Vbulletin
Vbulletin
9.8
100%
Sep 24vBulletin PHP Module Remote Code Execution Vulnerability
CVE-2018-15493
VB
Vbulletin
Vbulletin
6.1
1%
Oct 17vBulletin 5.4.3 has an Open Redirect
CVE-2018-6200
VB
Vbulletin
Vbulletin
6.1
3%
Jan 25vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter
CVE-2017-17672
VB
Vbulletin
Vbulletin
9.8
15%
Dec 14In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution,…
CVE-2017-17671
VB
Vbulletin
Vbulletin
9.8
3%
Dec 14vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal…
CVE-2015-3419
VB
Vbulletin
Vbulletin
6.5
1%
Sep 19vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input…
CVE-2014-9469
VB
Vbulletin
Vbulletin
6.1
1%
Aug 28Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3
CVE-2017-7569
VB
Vbulletin
Vbulletin
8.6
1%
Apr 6In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037
CVE-2016-6483
VB
Vbulletin
Vbulletin
8.6
12%
Sep 2The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch…
CVE-2016-6195
VB
Vbulletin
Vbulletin
9.8
71%
Aug 30SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute…
CVE-2015-7808
VB
Vbulletin
Vbulletin
–
81%
Nov 24The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code…
CVE-2014-9438
VB
Vbulletin
Vbulletin
–
1%
Jan 2Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for…
CVE-2014-8670
VB
Vbulletin
Vbulletin
–
2%
Nov 6Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url…
CVE-2014-2021
VB
Vbulletin
Vbulletin
–
3%
Oct 25Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web…
CVE-2014-2022
VB
Vbulletin
Vbulletin
–
3%
Oct 15SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL…
CVE-2014-5102
VB
Vbulletin
Vbulletin
–
1%
Jul 25SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to…
CVE-2014-3135
VB
Vbulletin
Vbulletin
–
2%
Apr 30Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to…
CVE-2013-6129
VB
Vbulletin
Vbulletin
–
52%
Oct 19The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword],…
CVE-2013-3522
VB
Vbulletin
Vbulletin
–
27%
May 10SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL…
CVE-2011-5251
VB
Vbulletin
Vbulletin
–
2%
Dec 31Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the…
CVE-2012-4686
VB
Vbulletin
Vbulletin
–
1%
Aug 28SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter
CVE-2012-4328
MA
Mapi
Vbulletin
–
2%
Aug 14Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4.3 for vBulletin 3.x has unknown impact and…
CVE-2012-3844
VB
Vbulletin
Vbulletin
–
1%
Jul 3Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when…
CVE-2008-6256
VB
Vbulletin
Vbulletin
–
1%
Feb 24SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the…
CVE-2008-6255
VB
Vbulletin
Vbulletin
–
1%
Feb 24Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) answer parameter to…
CVE-2008-4706
VB
Vbgooglemap
Vbulletin
–
1%
Oct 23SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid parameter in a…
CVE-2008-3773
VB
Vbulletin
Vbulletin
–
4%
Aug 22Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users…
CVE-2008-3184
VB
Vbulletin
Vbulletin
–
2%
Jul 15Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web…
CVE-2008-2744
VB
Vbulletin
Vbulletin
–
2%
Jun 17Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method."…
CVE-2008-2460
VB
Vbulletin
Vbulletin
–
1%
May 27SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action