CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/05/2025 |
| CVE-2023-39777 | 보통5.4 | A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter. | 16/09/2023 |
| CVE-2023-25135 | 심각9.8 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL | 03/02/2023 |
| CVE-2020-7373 | 심각9.8 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID | 30/10/2020 |
| CVE-2020-25124 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI. | 03/09/2020 |
| CVE-2020-25123 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager. | 03/09/2020 |
| CVE-2020-25122 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager. | 03/09/2020 |
| CVE-2020-25121 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options. | 03/09/2020 |
| CVE-2020-25120 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI. | 03/09/2020 |
| CVE-2020-25119 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual. | 03/09/2020 |
| CVE-2020-25118 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager. | 03/09/2020 |
| CVE-2020-25117 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager. | 03/09/2020 |
| CVE-2020-25116 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager. | 03/09/2020 |
| CVE-2020-25115 | 보통4.8 | The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager. | 03/09/2020 |
| CVE-2020-17496KEV | 심각9.8 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. | 12/08/2020 |
| CVE-2020-12720 | 심각9.8 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. | 08/05/2020 |
| CVE-2019-17271 | 보통4.9 | vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter. | 08/10/2019 |
| CVE-2019-17132 | 심각9.8 | vBulletin through 5.5.4 mishandles custom avatars. | 04/10/2019 |