CVE-2014-9463 describes a critical remote authenticated code execution vulnerability within the VBSEO module for vBulletin, specifically in functions_vbseo_hook.php. An authenticated attacker can exploit this flaw by injecting arbitrary code via the HTTP Referer header when accessing visitormessage.php. With a CVSS score of 8.8 (High), it presents a low-complexity attack requiring low privileges, leading to high impacts on confidentiality, integrity, and availability. Although not currently listed on CISA's KEV catalog, a public exploit is available on ExploitDB. Despite its "Hot List: Active" status, community discussion and media coverage remain low, and its EPSS score suggests a low probability of widespread exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:vbseo:vbseo:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.