vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa
http://packetstormsecurity.com/files/154758/vBulletin-5.5.4-SQL-Injection.html