vBulletin PHP Module Remote Code Execution Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2020-17496 · Published 12/08/2020 · updated 17/06/2026

vBulletin PHP Module Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
vbulletin vbulletin	`≥ 5.5.4, ≤ 5.6.2`	No fix yet

Description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

References

blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail · Exploit
cwe.mitre.org/data/definitions/78.html · Technical Description
forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch · Patch
seclists.org/fulldisclosure/2020/Aug/5 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-17496

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free