| Package | Affected versions | Patched versions |
|---|---|---|
| vbulletin | = 5.6.7= 5.6.8= 5.6.9 |
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free