CVE-2019-16759
vBulletin PHP Module Remote Code Execution Vulnerability
Published Sep 24, 2019 · updated Jun 16, 2026 · vbulletin vbulletin
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Timeline
Detection, updates, and resolution for this record.
Sep 24, 2019 · Catalog
Detected
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe vbulletin/vbulletinversion unspecified
- vendor vBulletin vBulletinversion unspecified
Sources
- CISA KEVCVE-2019-16759
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
cisa.gov - CVE.orgCVE-2019-16759
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-16759
30-day exploitation probability 99.7%
first.org - Exploit Database47437
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47447
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/vbulletin_widgetconfig_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-16759
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com