PT-2025-30595 · Vbulletin · Vbulletin

Published 2025-07-23 · Updated 2025-07-23 · CVE-2025-46171

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vBulletin version 3.8.7

Description vBulletin is susceptible to a denial-of-service condition through the misc.php?do=buddylist endpoint. Processing a large buddy list by an authenticated user can lead to excessive memory consumption, potentially exhausting system resources and causing the forum to crash.

Recommendations For vBulletin version 3.8.7, limit the size of buddy lists to prevent excessive memory usage.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-46171

Affected Products

Vbulletin

References · 7

• 🔥 https://github.com/oiyl/CVE-2025-46171 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46171 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46171 · Vendor Advisory
• https://t.me/CVEtracker/28508 · Telegram Post
• http://vbulletin.com · Note
• https://twitter.com/VulmonFeeds/status/1948085818209288446 · Twitter Post
• https://twitter.com/CVEnew/status/1948050431155847274 · Twitter Post