CVSS: 7.5EPSS: 78%CPEs: 2EXPL: 2CVE-2013-6129 – vBulletin 4.1.x - '/install/upgrade.php' Security Bypass
https://notcve.org/view.php?id=CVE-2013-6129
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013. Los scripts install/upgrade.php en vBulletin 4.1 y 5 permite a atacantes remotos crear cuentas administrativas a traves de los parámetros customerid, htmldata[password], htmldata[confirmpassword], y htmldata[email], como fue explotado activamente en Octubre 2013. • https://www.exploit-db.com/exploits/38785 http://www.net-security.org/secworld.php?id=15743 http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 38%CPEs: 2EXPL: 3CVE-2013-3522 – vBulletin 5 - 'index.php/ajax/api/reputation/vote?nodeid' SQL Injection
https://notcve.org/view.php?id=CVE-2013-3522
SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter. Vulnerabilidad de inyección SQL en index.php/ajax/api/reputation/vote en vBulletin v5.0.0 Beta 11, v5.0.0 Beta 28, y anteriores permite a usuarios remotos autenticados ejecutar comandos SQL a través del parámetro "nodeid". • https://www.exploit-db.com/exploits/30212 https://www.exploit-db.com/exploits/24882 http://www.exploit-db.com/exploits/24882 http://www.osvdb.org/92031 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •