According to the self-reported version in its response header, the version of vBulletin hosted on the remote web server is 5.5.x < 5.5.2 Patch Level 2, 5.5.3 < 5.5.3 Patch Level 2 or 5.5.4 < 5.5.4 Patch Level 2. It is, therefore, affected by multiples vulnerabilities :

 - A SQL injection vulnerability via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter

 - A remote code execution vulnerability via data[extension] and data[filedata] parameters within ajax/api/user/updateAvatar endpoint

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
98776	vBulletin 5.5.x < 5.5.2 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	12/12/2019	3/14/2023	critical
98774	vBulletin 5.5.4 < 5.5.4 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	12/12/2019	3/14/2023	critical
98775	vBulletin 5.5.3 < 5.5.3 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	12/12/2019	3/14/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical