Page 7 of 35 results (0.023 seconds)

CVSS: 7.5EPSS: 88%CPEs: 29EXPL: 2

CVE-2005-0511 – vBulletin - 'misc.php' Template Name Arbitrary Code Execution

https://notcve.org/view.php?id=CVE-2005-0511

misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter. • https://www.exploit-db.com/exploits/16896 https://www.exploit-db.com/exploits/832 http://marc.info/?l=bugtraq&m=110910899415763&w=2 http://secunia.com/advisories/14326 http://www.securityfocus.com/bid/12622 http://www.vbulletin.com/forum/showthread.php?postid=819562 •

CVSS: 5.0EPSS: 1%CPEs: 5EXPL: 2

CVE-2005-0429 – vBulletin 3.0.4 - 'forumdisplay.php' Code Execution

https://notcve.org/view.php?id=CVE-2005-0429

Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attackers to execute inject arbitrary PHP commands via the comma parameter. • https://www.exploit-db.com/exploits/818 https://www.exploit-db.com/exploits/820 http://marc.info/?l=bugtraq&m=110840807415315&w=2 http://www.securityfocus.com/bid/12542 •

CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1

CVE-2004-1515 – vBulletin - 'LAST.php' SQL Injection

https://notcve.org/view.php?id=CVE-2004-1515

SQL injection vulnerability in (1) ttlast.php and (2) last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as demonstrated using last.php. • https://www.exploit-db.com/exploits/631 http://marc.info/?l=bugtraq&m=110019198507100&w=2 •

CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 2

CVE-2004-2288 – vBulletin 1.0/2.x/3.0 - 'index.php' User Interface Spoofing

https://notcve.org/view.php?id=CVE-2004-2288

Cross-site scripting (XSS) vulnerability in index.php in Jelsoft vBulletin allows remote attackers to spoof parts of a website via the loc parameter. • https://www.exploit-db.com/exploits/24124 http://www.infosecurity.org.cn/article/hacker/exploit/16557.html http://www.securityfocus.com/bid/10362 •

CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0

CVE-2004-2695

https://notcve.org/view.php?id=CVE-2004-2695

SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the x_invoice_num parameter. NOTE: this issue might be related to CVE-2006-4267. • http://secunia.com/advisories/12531 http://www.securiteam.com/unixfocus/5BP0E15E0M.html http://www.securityfocus.com/bid/11193 http://www.vbulletin.com/forum/bugs.php?do=view&bugid=3379 http://www.vbulletin.com/forum/showthread.php?t=124876 https://exchange.xforce.ibmcloud.com/vulnerabilities/17365 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •