Jelsoft vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2007-4120 Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfilHigh 9.3 · Aug 1, 2007
• CVE-2007-3196 SQL injection vulnerability in vBSupport.php in vSupport Integrated Ticket System 3.x.x allows remote attackers to execute arbitrary SQL commands via the ticketHigh 7.5 · Jun 12, 2007
• CVE-2007-3197 SQL injection vulnerability in vBSupport.php in vBSupport 1.1 before 1.1a allows remote attackers to execute arbitrary SQL commands via unspecified vectors.High 7.5 · Jun 12, 2007
• CVE-2007-2911 SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commHigh 8.5 · May 30, 2007
• CVE-2007-1292 SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to High 7.5 · Mar 6, 2007
• CVE-2006-5104 SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter.High 7.5 · Oct 3, 2006
• CVE-2006-4271 PHP remote file inclusion vulnerability in install/upgrade_301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL inHigh 7.5 · Aug 21, 2006
• CVE-2006-4272 Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of High 7.5 · Aug 21, 2006
• CVE-2006-2018 SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter.High 7.5 · Apr 25, 2006
• CVE-2006-1382 PHP remote file inclusion vulnerability in impex/ImpExData.php in vBulletin ImpEx module 1.74, when register_globals is disabled, allows remote attackers to incHigh 7.5 · Mar 24, 2006
• CVE-2005-3019 Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrHigh 7.5 · Sep 21, 2005
• CVE-2005-3022 Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameteHigh 7.5 · Sep 21, 2005
• CVE-2005-3024 Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameteHigh 7.5 · Sep 21, 2005
• CVE-2005-0511 misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nestedHigh 7.5 · Feb 21, 2005
• CVE-2004-1515 SQL injection vulnerability in (1) ttlast.php and (2) last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parHigh 7.5 · Dec 31, 2004
• CVE-2004-2695 SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to eHigh 7.5 · Dec 31, 2004
• CVE-2002-1660 calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter.High 7.5 · Dec 31, 2002
• CVE-2001-0475 index.php in Jelsoft vBulletin does not properly initialize a PHP variable that is used to store template information, which allows remote attackers to execute High 7.5 · Jun 27, 2001