vBulletin 5.0.0 Beta 28
Approved changes feed: RSS · Atom
cpe:2.3:a:vbulletin:vbulletin:5.0.0:beta_28:*:*:*:*:*:*
part: a version: 5.0.0 update: beta_28
| Vendor | Vbulletin (002a8cbf-7d43-58a0-9ee0-802b9d8095a5) |
|---|---|
| Product | Vbulletin (a3b5d96b-8a9a-5cea-a87e-7d390f5ca893) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-17672 |
vulnerable | 2026-06-08 05:09:09.724684 |
Details available
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
Published: 2017-12-14T00:00:00.000Z
Updated: 2024-08-05T20:59:17.366Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-17671 |
vulnerable | 2026-06-08 05:09:09.724198 |
Details available
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.
Published: 2017-12-14T00:00:00.000Z
Updated: 2024-08-05T20:59:17.456Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3419 |
vulnerable | 2026-06-08 05:06:38.263739 |
Details available
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
Published: 2017-09-19T15:00:00.000Z
Updated: 2024-08-06T05:47:57.839Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-3522 |
vulnerable | 2026-06-08 05:04:31.883007 |
Details available
SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.
Published: 2013-05-10T21:00:00.000Z
Updated: 2024-09-16T18:55:19.974Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.