Live › vulnerability › CVE-2020-17496
Go to dashboardUnauthenticated RCE in vBulletin 5.5.4 through 5.6.2: one POST to /ajax/render/widget_tabbedcontainer_tab_panel with subWidgets[0][template]=widget_php runs attacker PHP. It bypasses the earlier CVE-2019-16759 fix. A public PoC exists and exploitation is active (CISA KEV, Unit 42). vBulletin Cloud is not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vBulletin vBulletin | vendor | – | – |
| vBulletin | vendor | >= 5.5.4, <= 5.6.2 (without Aug 2020 security patch) | 5.6.0 security patch, 5.6.1 security patch, 5.6.2 security patch |
5.5.45.6.25.6.0, 5.6.1 or 5.6.2) from the Member's Area5.6.2 plus the patch5.6.3 Beta is unpatched and not for productionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-17496")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.