CVE-2006-2018: Jelsoft vBulletin

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter. NOTE: the affected version has been disputed by the vendor. It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4.

Affected products

• Jelsoft vBulletin: version 3.0 only; version 3.0.0 only; version 3.0.0_beta_2 only; version 3.0.0_can4 only; version 3.0.0_rc4 only; version 3.0.1 only; …

Published 2006-04-25. Last modified 2026-06-16.