CVE-2005-3024: Jelsoft vBulletin

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread[forumid] or (3) criteria parameters to thread.php, (4) userid parameter to user.php, the (5) calendarcustomfieldid, (6) calendarid, (7) moderatorid, (8) holidayid, (9) calendarmoderatorid, or (10) calendar[0] parameters to admincalendar.php, (11) the cronid parameter to cronlog.php, (12) user[usergroupid][0] parameter to email.php, (13) help[0] parameter to help.php, the (14) limitnumber or (15) limitstart parameter to user.php, the (16) usertitleid or (17) ids parameters to usertitle.php, (18) rvt[0] parameter to language.php, (19) keep[0] parameter to phrase.php, (20) dostyleid parameter to template.php, (21) thread[forumid] parameter to thread.php, or (22) usertools.php.

Affected products

• Jelsoft vBulletin: version 1.0.1 only; version 2.0.3 only; version 2.0_rc2 only; version 2.0_rc3 only; version 2.2.0 only; version 2.2.1 only; …

Published 2005-09-21. Last modified 2026-06-16.