Vbulletin vulnerabilitiesRanked by how likely they are to be used.
Vbulletin is made by Jelsoft. We track 55 published vulnerabilities in it, across 68 versions. None of them is on the list of flaws known to be exploited today. If you run Vbulletin, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Vbulletin vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Vbulletin's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Vbulletin flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 36%CVE-2005-0511High
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
- 11%CVE-2002-1660High
calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter.
- 3.9%CVE-2005-3019High
Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to...
- 3.6%CVE-2004-0620Medium
Cross-site scripting (XSS) vulnerability in (1) newreply.php or (2) newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script as other users via the Edit-panel.
- 3.6%CVE-2002-1922Medium
Cross-site scripting (XSS) vulnerability in global.php in Jelsoft vBulletin 2.0.0 through 2.2.8 allows remote attackers to inject arbitrary web script or HTML via the (1) $scriptpath or (2) $url variables.
- 3.5%CVE-2006-6779Medium
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript.
- 3.4%CVE-2006-2335Medium
Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then...
- 2.9%CVE-2006-1816Medium
PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php,...
- 2.8%CVE-2001-0475High
index.php in Jelsoft vBulletin does not properly initialize a PHP variable that is used to store template information, which allows remote attackers to execute arbitrary PHP code via special characters in the...
- 2.6%CVE-2006-1040Medium
Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in...
Running Vbulletin? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
- Matched to
- Vbulletin on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 55 published vulnerabilities listed under the name Vbulletin, across 68 versions.
None of Vbulletin's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Vbulletin. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.