| Package | Affected versions | Patched versions |
|---|---|---|
| vbulletin | = 5.0.0≥ 5.0.1, ≤ 5.3.3 |
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free