vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widget_php routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
id: CVE-2019-16759
info:
name: vBulletin 5.0.0-5.5.4 - Remote Command Execution
author: madrobo
...