CVE-2005-3022: Jelsoft vBulletin

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, (2) userid parameter to user.php, (3) calendar parameter to admincalendar.php, (4) cronid parameter to cronlog.php, (5) usergroupid parameter to email.php, (6) help parameter to help.php, (7) rvt parameter to language.php, (8) keep parameter to phrase.php, or (9) updateprofilepic parameter to usertools.php.

Affected products

• Jelsoft vBulletin: version 1.0.1 only; version 2.0.3 only; version 2.0_rc2 only; version 2.0_rc3 only; version 2.2.0 only; version 2.2.1 only; …

Published 2005-09-21. Last modified 2026-06-16.