CVE-2005-0511: Jelsoft vBulletin

High severity, CVSS 7.5. EPSS: 35.8% chance of exploitation in the next 30 days.

misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.

Affected products

• Jelsoft vBulletin: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0_beta_2 only; version 2.0_beta_3 only; version 2.2.0 only; …

Published 2005-02-21. Last modified 2026-06-16.