CVE-2026-61511 | Critical | 9.8 | 2026-07-27 | vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template r… |
CVE-2025-46171 | Medium | 5.4 | 2025-07-23 | vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy… |
CVE-2025-48828 | Critical | 9.0 | 2025-05-27 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template co… |
CVE-2025-48827 | Critical | 10.0 | 2025-05-27 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or late… |
CVE-2023-39777 | Medium | 5.4 | 2023-09-16 | A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-25135 | Critical | 9.8 | 2023-02-03 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This o… |
CVE-2020-7373 | Critical | 9.8 | 2020-10-30 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: thi… |
CVE-2020-25124 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI. |
CVE-2020-25123 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager. |
CVE-2020-25122 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager. |
CVE-2020-25121 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options. |
CVE-2020-25120 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI. |
CVE-2020-25119 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual. |
CVE-2020-25118 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager. |
CVE-2020-25117 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager. |
CVE-2020-25116 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager. |
CVE-2020-25115 | Medium | 4.8 | 2020-09-03 | The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager. |
CVE-2020-17496 | Critical | 9.8 | 2020-08-12 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: thi… |
CVE-2020-12720 | Critical | 9.8 | 2020-05-08 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. |
CVE-2019-17271 | Medium | 4.9 | 2019-10-08 | vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter. |
CVE-2019-17132 | Critical | 9.8 | 2019-10-04 | vBulletin through 5.5.4 mishandles custom avatars. |
CVE-2019-17131 | Medium | 4.3 | 2019-10-04 | vBulletin before 5.5.4 allows clickjacking. |
CVE-2019-17130 | Medium | 6.5 | 2019-10-04 | vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories. |
CVE-2019-16759 | Critical | 9.8 | 2019-09-24 | vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. |
CVE-2018-15493 | Medium | 6.1 | 2018-10-17 | vBulletin 5.4.3 has an Open Redirect. |
CVE-2018-6200 | Medium | 6.1 | 2018-01-25 | vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter. |
CVE-2017-17672 | Critical | 9.8 | 2017-12-14 | In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, c… |
CVE-2017-17671 | Critical | 9.8 | 2017-12-14 | vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include d… |
CVE-2015-3419 | Medium | 6.5 | 2017-09-19 | vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related… |
CVE-2014-9463 | High | 8.8 | 2017-09-15 | functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitorme… |
CVE-2014-9469 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3. |
CVE-2017-7569 | High | 8.6 | 2017-04-06 | In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url functio… |
CVE-2016-6483 | High | 8.6 | 2016-09-02 | The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6… |
CVE-2016-6195 | Critical | 9.8 | 2016-08-30 | SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attacke… |
CVE-2015-7808 | | | 2015-11-24 | The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute… |
CVE-2014-9438 | | | 2015-01-02 | Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of admin… |
CVE-2014-8670 | | | 2014-11-06 | Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a UR… |
CVE-2014-2021 | | | 2014-10-25 | Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inj… |
CVE-2014-2022 | | | 2014-10-15 | SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to exe… |
CVE-2014-5102 | | | 2014-07-25 | SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] par… |
CVE-2014-3135 | | | 2014-04-30 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_I… |
CVE-2013-6129 | | | 2013-10-19 | The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldat… |
CVE-2013-3522 | | | 2013-05-10 | SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to e… |
CVE-2011-5251 | | | 2012-12-31 | Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phis… |
CVE-2012-4686 | | | 2012-08-28 | SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter. |
CVE-2012-4328 | | | 2012-08-14 | Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4.3 for vBulletin 3.x has unkn… |
CVE-2012-3844 | | | 2012-07-03 | Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject pa… |
CVE-2010-1077 | | | 2010-03-23 | Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local… |
CVE-2008-6256 | | | 2009-02-24 | SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands vi… |
CVE-2008-6255 | | | 2009-02-24 | Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) answer parame… |
CVE-2008-4706 | | | 2008-10-23 | SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid p… |
CVE-2008-3773 | | | 2008-08-22 | Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote a… |
CVE-2008-3184 | | | 2008-07-15 | Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject… |
CVE-2008-2744 | | | 2008-06-17 | Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and a… |
CVE-2008-2460 | | | 2008-05-27 | SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action. |