CVE-2019-16759

vBulletin PHP Module Remote Code Execution Vulnerability

n/a

CVSS

99.7%

EPSS (exploit prob.)

100.0%

EPSS percentile

Yes

Actively exploited

Ransomware use

2021-11-03

Added

Summary

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Affected software

Vendor: vBulletin · Product: vBulletin

Weakness types (CWE):

What to do

This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.

Related vulnerabilities in vBulletin

CVE	Name	EPSS	Exploited
CVE-2020-17496	vBulletin PHP Module Remote Code Execution Vulnerability	87.7%	Yes

Is your domain exposed?

Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.

Get your free report

All information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.