CVE-2006-2805 SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter.

MediumCVSS 5.0 EPSS 0.88% Public exploit

Published: 2006-06-03 13:00
Updated: 2026-06-17 01:25
Exploit status: Public exploit available

Sign in for asset impact Search another CVE

Description

SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter.

Affected products

Product	Affected versions	Fixed in
jelsoft vbulletin	= 3.0.10	No fix listed

References

downloads.securityfocus.com exploit
18197 exploit vdb-entry

CVSS v2.0

5.0 Medium

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: None
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.88% (percentile 59.8)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

vBulletin 3.0.10 - 'Portal.php' SQL Injection Exploit · Exploit Database (OffSec) · 2006-05-31