CVE-2020-17496

Timeline

Detection, updates, and resolution for this record.

1. Aug 12, 2020 · Catalog

   Detected

   The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

Affected

• cpe vbulletin/vbulletinversion unspecified
• vendor vBulletin vBulletinversion unspecified

Sources

• CISA KEVCVE-2020-17496

  The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

  cisa.gov
• CVE.orgCVE-2020-17496

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2020-17496

  30-day exploitation probability 87.4%

  first.org
• Metasploit Modulesexploit_multi/http/vbulletin_widget_template_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2020-17496

  vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

  nvd.nist.gov

References

• Exploit · blog.exploitee.rs
• Technical Description · cwe.mitre.org
• Patch · forum.vbulletin.com
• CISA note · nvd.nist.gov
• Exploit · seclists.org