Live › vulnerability › CVE-2019-16759
Go to dashboardvBulletin's PHP widget module lets an unauthenticated remote user send a crafted request to the widget_php route and run arbitrary PHP code on the server. An attacker gets full control of the forum host and its data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vBulletin vBulletin | vendor | – | – |
| vBulletin | vendor | >= 5.0.0, <= 5.5.4 (without Patch Level 1) | 5.5.2 Patch Level 1, 5.5.3 Patch Level 1, 5.5.4 Patch Level 1 |
5.0.05.5.4Enable PHP, Static HTML, and Ad Module rendering)5.5.2, 5.5.3 or 5.5.4; users on older 5.x should upgrade to one of thoseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2019-16759")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.