GCVE - cpe:2.3:a:vbulletin:vbulletin:3.8.7:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vbulletin:vbulletin:3.8.7:*:*:*:*:*:*:*

part: a version: 3.8.7 update: *

Vendor	Vbulletin (`002a8cbf-7d43-58a0-9ee0-802b9d8095a5`)
Product	Vbulletin (`a3b5d96b-8a9a-5cea-a87e-7d390f5ca893`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-46171`	vulnerable	2026-06-08 07:25:11.292702	Details available vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum. Published: 2025-07-23T00:00:00.000Z Updated: 2026-07-05T01:04:36.795Z Open on db.gcve.eu Reference links https://github.com/oiyl/CVE-2025-46171	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6483`	vulnerable	2026-06-08 05:08:02.584119	Details available The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code. Published: 2016-09-02T01:00:00.000Z Updated: 2024-08-06T01:29:20.172Z Open on db.gcve.eu Reference links http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2 https://www.exploit-db.com/exploits/40225/ http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9469`	vulnerable	2026-06-08 05:06:11.845932	Details available Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3. Published: 2017-08-28T15:00:00.000Z Updated: 2024-08-06T13:47:41.431Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/72592 http://packetstormsecurity.com/files/130393/vBulletin-5.1.3-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Feb/49	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.