vulnerability
vBulletin: CVE-2019-16759: Improper Control of Generation of Code
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Sep 24, 2019 | Jul 1, 2025 | Jul 1, 2025 |
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Sep 24, 2019
Added
Jul 1, 2025
Modified
Jul 1, 2025
Description
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Solution
vbulletin-upgrade-latest
References
- CVE-2019-16759
- https://attackerkb.com/topics/CVE-2019-16759
- URL-http://seclists.org/fulldisclosure/2020/Aug/5
- URL-https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/
- URL-https://seclists.org/fulldisclosure/2019/Sep/31
- URL-https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/
- CWE-94
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.