Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2019-16759

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring re

Published
Last modified
published
Listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

vBulletin, a popular forum software platform, is affected by this vulnerability, which allows an attacker to run arbitrary commands on the server remotely. This could let an attacker take full control of the affected website and its underlying server, potentially accessing or altering data.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a n/a

    Version range not reported

References 10

seclists.org

theregister.co.uk

arstechnica.com

packetstormsecurity.com