vBulletin vendor intelligence
vBulletin Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting vBulletin products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 9
- Known exploited vulnerabilities affecting vBulletin products
- In CISA KEV
- 2
- Records also listed in the official catalog
- Beyond CISA KEV
- 7
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 2
- vBulletin KEVs with sensor-observed exploitation activity
The catalog gap matters for vBulletin exposure
Seven of the nine exploited vBulletin vulnerabilities tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 78% of this vendor portfolio.
- 22%
- Covered by CISA
- 78%
- Beyond CISA
- 1
- Product families
Attested vBulletin vulnerabilities
9 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-61511
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php |
vBulletin | Confirmed | Beyond CISA | 27 Aug 2026 |
|
CVE-2025-48828
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting... |
vBulletin | Confirmed | Beyond CISA | 27 May 2025 |
|
CVE-2025-48827
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP... |
vBulletin | High | Beyond CISA | 03 Jun 2026 |
|
CVE-2023-25135
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers... |
vBulletin | High | Beyond CISA | 07 Jul 2025 |
|
CVE-2020-12720
vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. |
vBulletin | High | Beyond CISA | 25 Jun 2025 |
|
CVE-2016-6195
SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows... |
vBulletin | High | Beyond CISA | 30 Aug 2016 |
|
CVE-2013-6129
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid,... |
vBulletin | High | Beyond CISA | 19 Oct 2013 |
|
CVE-2020-17496
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel... |
vBulletin | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2019-16759
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. |
vBulletin | Confirmed | In CISA | 03 Nov 2021 |
No vBulletin vulnerabilities match this search or filter.
Showing 9 of 9 vBulletin known exploited vulnerabilities.
Recurring weakness patterns
Protection, neutralization, and deserialization account for five mapped occurrences across this vBulletin KEV portfolio.
CWE-424
Improper Protection of Alternate Path
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-502
Deserialization of Untrusted Data
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-264
Permissions, Privileges, and Access Controls
CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-306
Missing Authentication for Critical Function