vBulletin vulnerabilities
We track 6 vulnerabilities in vBulletin products. 6 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on July 27, 2026.
Latest vBulletin vulnerabilities
- 9.8 Critical severity
vBulletin: Improper Neutralization of Directives in Dynamically Evaluated Code
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafte
- 8.1 High severity
vBulletin: Improper Protection of Alternate Path
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers
- 9.8 Critical severity
vBulletin: Improper Protection of Alternate Path
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 20
- 9.8 Critical severity
Vbulletin: Deserialization of Untrusted Data
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then che
- 9.8 Critical severity
vBulletin PHP Module Remote Code Execution Exploited
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
- 9.8 Critical severity
vBulletin PHP Module Remote Code Execution Exploited
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.