vBulletin vendor intelligence
vBulletin Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting vBulletin products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 8
- Known exploited vulnerabilities affecting vBulletin products
- In CISA KEV
- 2
- Records also listed in the official catalog
- Beyond CISA KEV
- 6
- Additional exploited CVEs absent from CISA KEV
- Sensor Observed
- 1
- vBulletin KEV with sensor-observed exploitation activity
The catalog gap matters for vBulletin exposure
Six of the eight exploited vBulletin CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss three-quarters of this vendor portfolio.
- 25%
- Covered by CISA
- 75%
- Beyond CISA
- 1
- Product families
Attested vBulletin CVEs
Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2025-48828
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting... |
vBulletin | Confirmed | Beyond CISA | 27 May 2025 |
|
CVE-2025-48827
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP... |
vBulletin | High | Beyond CISA | 03 Jun 2026 |
|
CVE-2023-25135
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers... |
vBulletin | High | Beyond CISA | 07 Jul 2025 |
|
CVE-2020-12720
vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. |
vBulletin | High | Beyond CISA | 25 Jun 2025 |
|
CVE-2016-6195
SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows... |
vBulletin | High | Beyond CISA | 30 Aug 2016 |
|
CVE-2013-6129
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid,... |
vBulletin | High | Beyond CISA | 19 Oct 2013 |
|
CVE-2020-17496
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel... |
vBulletin | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2019-16759
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. |
vBulletin | Confirmed | In CISA | 03 Nov 2021 |
No vBulletin CVEs match this search or filter.
Showing 8 of 8 vBulletin known exploited vulnerabilities.
Recurring weakness patterns
Neutralization, protection, and permissions, privileges, and access controls account for five mapped occurrences across this vBulletin KEV portfolio.
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-424
Improper Protection of Alternate Path
CWE-264
Permissions, Privileges, and Access Controls
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-502
Deserialization of Untrusted Data
CWE-306
Missing Authentication for Critical Function
Early warning alerts
Get alerts on high-impact exploitation
Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.