{"id":"CVE-2019-16759","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-16759","generatedAt":"2026-10-27T21:19:31.721Z","title":"vBulletin PHP Module Remote Code Execution Vulnerability","description":"vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.","published":"2019-09-24T22:15:13.000Z","lastModified":"2026-06-17T02:22:44.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-94"],"affected":["vbulletin/vbulletin"],"epss":{"score":0.99728,"percentile":0.99953,"date":"2026-10-26","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-16759"},"exploits":{"count":2,"verified":false,"firstPublished":"2019-09-23","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":47437,"kind":"exploit","title":"vBulletin 5.x - Remote Command Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/47437","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/47437.rb","file":"exploits/php/webapps/47437.rb","published":"2019-09-30","added":"2019-09-30","updated":"2019-09-30","author":"r00tpgp","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2019-16759"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":47447,"kind":"exploit","title":"vBulletin 5.0 < 5.5.4 - 'widget_php ' Unauthenticated Remote Code Execution","url":"https://www.exploit-db.com/exploits/47447","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/47447.py","file":"exploits/php/webapps/47447.py","published":"2019-09-23","added":"2019-10-01","updated":"2019-11-13","author":"anonymous","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2019-16759"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://seclists.org/fulldisclosure/2019/Sep/31"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2020/Aug/5","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://seclists.org/fulldisclosure/2019/Sep/31","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/","tags":["Press/Media Coverage","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2020/Aug/5","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/fulldisclosure/2019/Sep/31","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/","tags":["Press/Media Coverage","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-16759","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}