Show filters
100 Total Results
Displaying 1-10 of 100
Sort by:
Attacker Value
High
CVE-2023-25135
Disclosure Date: February 03, 2023 (last updated October 08, 2023)
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
2
Attacker Value
High
CVE-2020-7373
Disclosure Date: October 30, 2020 (last updated November 28, 2024)
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.
1
Attacker Value
High
CVE-2020-17496
Disclosure Date: August 12, 2020 (last updated November 28, 2024)
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
1
Attacker Value
High
CVE-2020-12720 vBulletin incorrect access control
Disclosure Date: May 08, 2020 (last updated October 06, 2023)
vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
1
Attacker Value
Unknown
CVE-2023-39777
Disclosure Date: September 16, 2023 (last updated October 08, 2023)
A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
0
Attacker Value
Unknown
CVE-2020-25117
Disclosure Date: September 03, 2020 (last updated November 28, 2024)
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
0
Attacker Value
Unknown
CVE-2020-25118
Disclosure Date: September 03, 2020 (last updated November 28, 2024)
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.
0
Attacker Value
Unknown
CVE-2020-25121
Disclosure Date: September 03, 2020 (last updated November 28, 2024)
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
0
Attacker Value
Unknown
CVE-2020-25123
Disclosure Date: September 03, 2020 (last updated November 28, 2024)
The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.
0
Attacker Value
Unknown
CVE-2020-25119
Disclosure Date: September 03, 2020 (last updated November 28, 2024)
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
0
