Vbulletin vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Vbulletin flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2020-17496 vBulletin PHP Module Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
• CVE-2019-16759 vBulletin PHP Module Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-61511 vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template ruCritical 9.3 · Jul 27, 2026
• CVE-2025-48828 Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.Critical 9 · May 27, 2025
• CVE-2025-48827 vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or laterCritical 10 · May 27, 2025
• CVE-2023-25135 vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization.Critical 9.8 · Feb 3, 2023
• CVE-2020-7373 vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request.Critical 9.8 · Oct 30, 2020
• CVE-2020-17496 vBulletin PHP Module Remote Code ExecutionExploited · Critical 9.8 · Aug 12, 2020
• CVE-2020-12720 vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.Critical 9.8 · May 7, 2020
• CVE-2019-17132 vBulletin through 5.5.4 mishandles custom avatars.Critical 9.8 · Oct 4, 2019
• CVE-2019-16759 vBulletin PHP Module Remote Code ExecutionExploited · Critical 9.8 · Sep 24, 2019
• CVE-2017-17672 In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, coCritical 9.8 · Dec 13, 2017
• CVE-2017-17671 vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include diCritical 9.8 · Dec 13, 2017
• CVE-2017-7569 In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url functionHigh 8.6 · Apr 6, 2017
• CVE-2016-6483 The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4High 8.6 · Sep 1, 2016
• CVE-2016-6195 SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackerCritical 9.8 · Aug 30, 2016
• CVE-2015-7808 The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute aHigh 7.5 · Nov 24, 2015
• CVE-2014-2022 SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execHigh 7.1 · Oct 15, 2014
• CVE-2014-5102 SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] paraHigh 7.5 · Jul 25, 2014
• CVE-2013-6129 The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldataHigh 7.5 · Oct 19, 2013
• CVE-2012-4686 SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter.High 7.5 · Aug 28, 2012
• CVE-2012-4328 Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4.3 for vBulletin 3.x has unknoHigh 10 · Aug 14, 2012
• CVE-2008-4706 SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid paHigh 7.5 · Oct 23, 2008
• CVE-2008-2460 SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action.High 7.5 · May 27, 2008