CVE-2026-9357
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in vBulletin 6.x in an unknown function of the Login component leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been made public.
Risk Assessment
A remote attacker can inject a malicious script that executes in the user's browser, potentially leading to session theft or data leakage.
Recommendation
Contact the vendor for a patch and implement temporary mitigations such as input filtering on the login form.
Other vulnerabilities in vBulletin
See all- CVE-2017-7569High
In vBulletin versions before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function.
- CVE-2016-6483High
The media-file upload feature in vBulletin before certain versions allows remote attackers to conduct SSRF attacks via a crafted URL, resulting in a Redirection HTTP status code.
- CVE-2026-61511Critical
vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method, allowing unauthenticated remote attackers to execute arbitrary PHP code via crafted pagenav[pagenumber] parameter.
- CVE-2020-17496CriticalActively exploited
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This issue exists because of an incomplete fix for CVE-2019-16759.
- CVE-2019-16759CriticalActively exploited
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. The flaw enables an attacker to execute arbitrary code on the server.
- CVE-2017-17672Critical
In vBulletin versions up to 5.3.x, there is an unauthenticated deserialization vulnerability that can lead to arbitrary file deletion and, under certain circumstances, code execution. This issue arises from the unsafe usage of PHP's unserialize() function in the cacheTemplates() method of the vB_Library_Template class, which is publicly exposed.
- CVE-2017-17671Critical
vBulletin versions up to 5.3.x on Windows allows remote PHP code execution due to the accessibility of a require_once call with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname. The blocking of ../ traversal does not apply to ..\, allowing for exploitation of this vulnerability.
- CVE-2025-46171Medium
A vulnerability in vBulletin 3.8.7 allows a DoS attack via the misc.php?do=buddylist endpoint. An authenticated user with an excessively large buddy list can cause excessive memory consumption, exhausting system resources and crashing the forum.
Original NVD description (English source)
A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. VulDB is withholding an extended redistribution of exploit details to prevent simplified exploitation. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS