Sploitus

85 exploited vulnerabilities in Vbulletin

Showing 1–50 of 85, highest-scoring first

Vendors
Php, Vbulletin, Vbulletin Solutions, Apache, Vbseo, Tapatalk
With known exploits
85
Affected Vbulletin versions
≤ 5.7.5, 6.0.3, 5.6.7, 5.6.8, 5.6.9, 5.6.2, 5.5.6, 5.6.0, 5.6.1.-, 5.5.4, 5.3.3, 5.0.0, 4.2.2, 4.2.3, 3.8.7, 3.8.8, 3.8.9, 5.2.0, 5.2.1, 5.2.2, 4.1, 4.1.10, 3.7.0, 4.2.0, 4.2.1
Affected Vbseo versions
All versions
Affected Tapatalk versions
= 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.3, 1.2.6, 2.0, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.2.0, 3.9.0, 3.9.1, 3.9.2, 3.9.3, 4.0.0, 4.1.0, 4.2.0, 4.2.1, 4.3.0, 4.3.1, 4.4.0, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.7.0, 4.7.1, 4.7.2, 4.8.0, 4.8.1, 4.9.0, 5.0.0, 5.0.1, 5.1.0
Affected Michael Brandon Vbgsitemap versions
= 2.41
Affected Jelsoft Vbulletin versions
≤ 3.5.8, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 2.3.0, 2.3.2, 2.3.3, 2.3.4, 2.3.8, 3.0, 3.0.0, 3.0.0_beta_2, 3.0.0_can4, 3.0.0_rc4, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.12, 3.0_beta_2, 1.0.1, 2.0.3, 2.0_rc2, 2.0_rc3, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 3.0.7, 3.0_beta_3, 3.0_beta_4, 3.0_beta_5, 3.0_beta_6, 3.0_beta_7, 3.0_gamma, 3.0.8, 3.0.9, 2.0, 2.0.1, 2.0.2, 2.0_beta_2, 2.0_beta_3, 2.2.9_can, 2.1.9, 3.5.1, 3.5.2, 3.5.4
Affected Mkportal versions
= 1.1

Vulnerabilities with exploits

Highest CVSS first — 32 of these already have exploit code on Sploitus

CVE-2025-48827 3 exploits
CVSS 10.0 CRITICAL 2025-05-23
📄 vBulletin 6.0.3 replaceAdTemplate Expression InjectionExploit for Improper Protection of Alternate Path in Vbulletin
CVE-2023-25135
CVSS 10.0 CRITICAL 2023-01-31FIX AVAILABLE
CVE-2020-17496 1 exploit
CVSS 10.0 CRITICAL 2020-08-12FIX AVAILABLE
vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution.
CVE-2026-61511 8 exploits
CVSS 9.8 CRITICAL 2026-07-27FIX AVAILABLE
Exploit for CVE-2026-61511Exploit for CVE-2026-61511
CVE-2020-7373 2 exploits
CVSS 9.8 CRITICAL 2020-10-30FIX AVAILABLE
vBulletin 5.x Remote Code ExecutionvBulletin 5.x Remote Code Execution Exploit
CVE-2020-12720 12 exploits
CVSS 9.8 CRITICAL 2020-05-07FIX AVAILABLE
vBulletin 5.6.1 SQL InjectionvBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection
CVE-2019-17132 4 exploits
CVSS 9.8 CRITICAL 2019-10-04FIX AVAILABLE
vBulletin 5.0 < 5.5.4 - (updateAvatar) Authenticated Remote Code Execution ExploitvBulletin 5.0 5.5.4 - updateAvatar Authenticated Remote Code Execution
CVE-2019-16759 27 exploits
CVSS 9.8 CRITICAL 2019-09-24
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_PlatformExploit for Code Injection in Vbulletin
CVE-2017-17672 5 exploits
CVSS 9.8 CRITICAL 2017-12-14
vBulletin 5 cacheTemplates Unauthenticated Remote Arbitrary File Deletion VulnerabilityvBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion(CVE-2017-17672)
CVE-2017-17671 1 exploit
CVSS 9.8 CRITICAL 2017-12-14FIX AVAILABLE
vBulletin LFI
CVE-2016-6195 7 exploits
CVSS 9.8 CRITICAL 2016-08-30FIX AVAILABLE
Exploit for Argument Injection in Phpmailer_Project PhpmailervBulletin 4 ForumRunner SQL Injection
CVE-2007-4120
CVSS 9.3 HIGH 2007-08-01
CVE-2025-48828 1 exploit
CVSS 9.0 CRITICAL 2025-05-23
Exploit for Improper Protection of Alternate Path in Vbulletin
CVE-2014-9463 3 exploits
CVSS 9.0 HIGH 2017-09-15
vBSEO 3.6.0 functions_vbseo_hook.php Referer RCEvBulletin 4.x.x visitormessage.php Remote Code Injection Vulnerability
CVE-2016-6483 5 exploits
CVSS 8.6 HIGH 2016-09-02FIX AVAILABLE
vBulletin 5.2.2 - Unauthenticated Server Side Request ForgeryvBulletin 5.2.2 - Server-Side Request Forgery
CVE-2014-2023 6 exploits
CVSS 7.5 HIGH 2017-10-26FIX AVAILABLE
Tapatalk for vBulletin 4.x - Blind SQL InjectionvBulletin 4.x Tapatalk Blind SQL Injection
CVE-2014-5102
CVSS 7.5 HIGH 2014-07-25FIX AVAILABLE
CVE-2013-6129 7 exploits
CVSS 7.5 HIGH 2013-10-19FIX AVAILABLE
vBulletin 4.5 Add AdministratorvBulletin 4.1 Add Administrator
CVE-2012-4686 1 exploit
CVSS 7.5 HIGH 2012-08-28FIX AVAILABLE
vBulletin 4.1.10 - 'announcementid' SQL Injection
CVE-2008-2460
CVSS 7.5 HIGH 2008-05-27FIX AVAILABLE
CVE-2007-2941 1 exploit
CVSS 7.5 HIGH 2007-05-31FIX AVAILABLE
vBulletin vBGSiteMap 2.41 - 'root' Remote File Inclusion
CVE-2007-1292 1 exploit
CVSS 7.5 HIGH 2007-03-07FIX AVAILABLE
vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection
CVE-2006-5104 1 exploit
CVSS 7.5 HIGH 2006-10-02FIX AVAILABLE
vBulletin 2.3.x - 'global.php' SQL Injection
CVE-2006-4271
CVSS 7.5 HIGH 2006-08-21FIX AVAILABLE
CVE-2006-2067 1 exploit
CVSS 7.5 HIGH 2006-04-27FIX AVAILABLE
MKPortal 1.1 - Multiple Input Validation Vulnerabilities
CVE-2006-2018
CVSS 7.5 HIGH 2006-04-25
CVE-2005-3024
CVSS 7.5 HIGH 2005-09-21FIX AVAILABLE
CVE-2005-3022
CVSS 7.5 HIGH 2005-09-21FIX AVAILABLE
CVE-2005-3019 4 exploits
CVSS 7.5 HIGH 2005-09-21FIX AVAILABLE
vBulletin 1.0.1 lite/2.x/3.0 - 'joinrequests.php?request' SQL InjectionvBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php' Multiple SQL Injections
CVE-2005-0511 4 exploits
CVSS 7.5 HIGH 2005-02-21FIX AVAILABLE
vBulletin - 'misc.php' Template Name Arbitrary Code Execution (Metasploit)vBulletin misc.php Template Name Arbitrary Code Execution
CVE-2004-1515 1 exploit
CVSS 7.5 HIGH 2004-12-31FIX AVAILABLE
vBulletin - 'LAST.php' SQL Injection
CVE-2002-1660 1 exploit
CVSS 7.5 HIGH 2002-12-31FIX AVAILABLE
vBulletin 2.0.3 - 'calendar.php' Command Execution
CVE-2001-0475
CVSS 7.5 HIGH 2001-06-27
CVE-2014-2022 3 exploits
CVSS 7.1 HIGH 2014-10-15FIX AVAILABLE
vBulletin 4.x SQL InjectionvBulletin 4.x - breadcrumbs via xmlrpc API (Authenticated) SQL Injection
CVE-2014-9438
CVSS 6.8 MEDIUM 2015-01-02
CVE-2010-1077 1 exploit
CVSS 6.8 MEDIUM 2010-03-23FIX AVAILABLE
vBSEO 3.1.0 - Local File Inclusion
CVE-2006-6779 1 exploit
CVSS 6.8 MEDIUM 2006-12-28
vBulletin 3.5.x/3.6.x - SWF Script Injection
CVE-2006-6040 1 exploit
CVSS 6.8 MEDIUM 2006-11-22FIX AVAILABLE
vBulletin 3.6.x - Admin Control Panel Multiple Cross-Site Scripting Vulnerabilities
CVE-2006-4273 1 exploit
CVSS 6.8 MEDIUM 2006-08-21FIX AVAILABLE
vBulletin 3.0.14 - 'global.php' Encoded Cross-Site Scripting
CVE-2003-0295 1 exploit
CVSS 6.8 MEDIUM 2003-05-15FIX AVAILABLE
vBulletin 3.0 - Private Message HTML Injection
CVE-2013-3522 9 exploits
CVSS 6.5 MEDIUM 2013-05-10FIX AVAILABLE
vBulletin 5.0.0 Beta 28 SQL InjectionvBulletin Password Collector via nodeid SQL Injection
CVE-2008-6256
CVSS 6.5 MEDIUM 2009-02-24FIX AVAILABLE
CVE-2007-3687 1 exploit
CVSS 6.5 MEDIUM 2007-07-11
vBulletin Mod RPG Inferno 2.4 - 'inferno.php' SQL Injection
CVE-2006-2335
CVSS 6.5 MEDIUM 2006-05-12FIX AVAILABLE
CVE-2018-6200
CVSS 6.1 MEDIUM 2018-01-25FIX AVAILABLE
CVE-2007-1573
CVSS 6.0 MEDIUM 2007-03-21FIX AVAILABLE
CVE-2014-8670
CVSS 5.8 MEDIUM 2014-11-06FIX AVAILABLE
CVE-2025-46171
CVSS 5.4 MEDIUM 2025-07-23FIX AVAILABLE
CVE-2023-39777
CVSS 5.4 MEDIUM 2023-09-16
CVE-2007-2912
CVSS 5.0 MEDIUM 2007-05-30FIX AVAILABLE