EIP-2026-112994

PRE-CVE

vBulletin 3.8.4/3.8.5 - Registration Bypass

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112994. PoCs published by Immortal Boy.

AI-analyzed exploit summary This document describes a username spoofing vulnerability in vBulletin 3.8.4 and 3.8.5, where an attacker can register with a username containing ASCII code &#00 to impersonate an admin user. The writeup includes steps to exploit and patch the vulnerability.

Description

vBulletin 3.8.4/3.8.5 - Registration Bypass

Exploits (1)

exploitdb WRITEUP
by Immortal Boy · textwebappsphp
https://www.exploit-db.com/exploits/14833

This document describes a username spoofing vulnerability in vBulletin 3.8.4 and 3.8.5, where an attacker can register with a username containing ASCII code &#00 to impersonate an admin user. The writeup includes steps to exploit and patch the vulnerability.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: vBulletin 3.8.4 & 3.8.5
No auth needed
Prerequisites: Access to the registration page of a vulnerable vBulletin instance
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026