CVE-2019-16759

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 24, 2019
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 3, 2021
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-16767.5A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticatCVE-2019-167607.5Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `pCVE-2019-167616.1A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-vaCVE-2019-167626.1A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs CVE-2019-167636.1In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attaCVE-2019-167645.5The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a valCVE-2019-167657.8If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension actCVE-2019-167668.8When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass thCVE-2019-167677.2The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launcCVE-2019-167684.3In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\SecuCVE-2019-167695.4The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate againstCVE-2019-16774.6A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack
CVE-2019-16759: Critical severity, CVSS 9.8 | Vulnix