CVE-2019-16759

9.8 CRITICAL CISA KEV - Actively Exploited

Published: September 24, 2019 Modified: November 07, 2025

Description

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html

Source: cve@mitre.org

Exploit Third Party Advisory VDB Entry

http://seclists.org/fulldisclosure/2020/Aug/5

Source: cve@mitre.org

Exploit Mailing List Third Party Advisory

https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/

Source: cve@mitre.org

Exploit Press/Media Coverage Third Party Advisory

https://seclists.org/fulldisclosure/2019/Sep/31

Source: cve@mitre.org

Exploit Mailing List Third Party Advisory

https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/

Source: cve@mitre.org

Press/Media Coverage Third Party Advisory

http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory VDB Entry

http://seclists.org/fulldisclosure/2020/Aug/5

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Mailing List Third Party Advisory

https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Press/Media Coverage Third Party Advisory

https://seclists.org/fulldisclosure/2019/Sep/31

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Mailing List Third Party Advisory

https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/

Source: af854a3a-2127-422b-91ae-364da2661108

Press/Media Coverage Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

21 reference(s) from NVD

Quick Stats

CVSS v3 Score

9.8 / 10.0

EPSS (Exploit Probability)

94.4%

100th percentile

Exploitation Status

Actively Exploited

Remediation due: 2022-05-03

Weaknesses (CWE)

CWE-94 CWE-94

Affected Vendors

vbulletin

Related CVEs