← All advisories

Critical severity9.8CISA KEVNVD Advisory· Published Sep 24, 2019· Updated Jun 17, 2026

CVE-2019-16759

CVE-2019-16759

Description

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Jelsoft/Vbulletin2 versions
cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*range: >=5.0.0,<=5.5.4
- (no CPE)range: 5.x through 5.5.4
vBulletin/vBulletindescription

Patches

Vulnerability mechanics

References

11

packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2020/Aug/5nvdExploitMailing ListThird Party Advisory
arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/nvdExploitPress/Media CoverageThird Party Advisory
seclists.org/fulldisclosure/2019/Sep/31nvdExploitMailing ListThird Party Advisory
www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/nvdPress/Media CoverageThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

0

No linked articles in our index yet.