4.2.0

DATE	CVE	VULNERABILITY TITLE	RISK
2023-09-16	CVE-2023-39777	Cross-site Scripting vulnerability in Vbulletin A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter. network low complexity vbulletin CWE-79	5.4
2019-10-08	CVE-2019-17271	SQL Injection vulnerability in Vbulletin vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter. network low complexity vbulletin CWE-89	4.9
2019-10-04	CVE-2019-17132	Improper Input Validation vulnerability in Vbulletin vBulletin through 5.5.4 mishandles custom avatars. network low complexity vbulletin CWE-20 critical	9.8
2019-10-04	CVE-2019-17131	Improper Restriction of Rendered UI Layers or Frames vulnerability in Vbulletin vBulletin before 5.5.4 allows clickjacking. network low complexity vbulletin CWE-1021	4.3
2019-10-04	CVE-2019-17130	Files or Directories Accessible to External Parties vulnerability in Vbulletin vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories. network low complexity vbulletin CWE-552	6.5
2018-01-25	CVE-2018-6200	Open Redirect vulnerability in Vbulletin vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter. network low complexity vbulletin CWE-601	6.1
2017-04-06	CVE-2017-7569	Server-Side Request Forgery (SSRF) vulnerability in Vbulletin In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037. network low complexity vbulletin CWE-918	8.6