vBulletin PHP Module Remote Code Execution Vulnerability

Mô tả

Tham khảo

• blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail · Exploit
• cwe.mitre.org/data/definitions/78.html · Technical Description
• forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch · Patch
• seclists.org/fulldisclosure/2020/Aug/5 · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2020-17496

Lỗ hổng khác của vbulletin

• CVE-2025-46171TRUNG BÌNH 5.4vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a suffic…
• CVE-2025-48828CAO 8.1Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By c…
• CVE-2025-48827NGHIÊM TRỌNG 9.8vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running…
• CVE-2023-39777TRUNG BÌNH 5.4A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web…
• CVE-2023-25135NGHIÊM TRỌNG 9.8vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers dese…