CVE-2004-1515: Jelsoft vBulletin

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

SQL injection vulnerability in (1) ttlast.php and (2) last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as demonstrated using last.php.

Affected products

• Jelsoft vBulletin: version 3.0.0 only; version 3.0.0_beta_2 only; version 3.0.0_can4 only; version 3.0.0_rc4 only; version 3.0.1 only; version 3.0.2 only; …

Published 2004-12-31. Last modified 2026-06-16.