CVE-2007-1292 json
SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote au…
published 2007-03-07 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-1289
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 1
- Exploit-DB
Summary
SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almost impossible to achieve."
Patch / fix
Timeline
- First public exploit (EDB-3387)
- Published
Exploit prediction
1.32% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-3387 vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection webapps, 2007-02-28
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
vbulletin.com
/forum/showthread.php?postid=1314422
patch, vendor-advisory
-
exploit-db.com
/exploits/3387
exploit
-
osvdb.org
/33835
vdb-entry
-
secunia.com
/advisories/24341
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/32746
vdb-entry
-
securityfocus.com
/bid/22780
vdb-entry
Sources
- CVE List CVE-2007-1292
- NVD CVE-2007-1292
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.