Critical severity9.8NVD Advisory· Published Dec 14, 2017· Updated May 13, 2026
CVE-2017-17672
CVE-2017-17672
Description
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- blogs.securiteam.com/index.php/archives/3573nvdExploitThird Party Advisory
- www.exploit-db.com/exploits/43362/nvdExploitThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.