CVE-2019-16759: vbulletin

csirt@kutim:~/threat-intel/cve/CVE-2019-16759

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,7%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vbulletin. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Rincian

Terbit di NVD: 24 September 2019
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 99,7% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: vBulletin PHP Module Remote Code Execution Vulnerability
Masuk KEV: 3 November 2021
Tenggat CISA: 3 Mei 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
vbulletin	vbulletin	Versi 5.0.0 hingga 5.5.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759 pemerintah AS
http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://seclists.org/fulldisclosure/2020/Aug/5 exploit · mailing list · advisory pihak ketiga
https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-se... exploit · press/media coverage · advisory pihak ketiga
https://seclists.org/fulldisclosure/2019/Sep/31 exploit · mailing list · advisory pihak ketiga
https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/ press/media coverage · advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.