Skip to content

Vbulletin · weakness class

SQL Injection

11 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

check available
2
likely to be exploited
1

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

  1. vBulletin SQL InjectionCVE-2020-12720Vbulletin · 89% likely

    CWE-89

  2. vBulletin <= 4.2.3 - SQL InjectionCVE-2016-6195Vbulletin · 71% likely

    CWE-89

  3. SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL…CVE-2013-3522Vbulletin · 27% likely

    CWE-89

  4. SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL c…CVE-2014-2022Vbulletin · 2.7% likely

    CWE-89

  5. vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.CVE-2019-17271Vbulletin · 1.4% likely

    CWE-89

  6. SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/rende…CVE-2014-5102Vbulletin · 1.4% likely

    CWE-89

  7. SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action.CVE-2008-2460Vbulletin · 1.1% likely

    CWE-89

  8. SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter.CVE-2012-4686Vbulletin · 1.1% likely

    CWE-89

  9. SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid parameter in a showde…CVE-2008-4706Vbulletin · 1.0% likely

    CWE-89

  10. SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinfo[re…CVE-2008-6256Vbulletin · 1.0% likely

    CWE-89

  11. Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) answer parameter to admincp/verif…CVE-2008-6255Vbulletin · 0.9% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.