CVE-2007-2941: Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSi...

Security readout for executives and security teams

This is an old remote file inclusion issue in vBGSiteMap 2.41 for vBulletin. If the vulnerable plugin is exposed, an attacker could make the server run attacker-supplied PHP. The source bundle does not provide CVSS, a vendor patch, or evidence of active exploitation. Exposure is most likely on legacy vBulletin forums running vBGSiteMap 2.41 with the vbgsitemap PHP files reachable from the web. The bundle’s structured affected-product fields are incomplete, so confirm exposure from installed code and asset inventory. Treat this as a high-priority legacy exposure check, not a broad enterprise emergency. The business risk is significant only where old vBulletin plugin code remains internet-facing, because successful exploitation could become server-side code execution. Mitigation focus: Inventory vBulletin sites for vBGSiteMap 2.41 and the named vbgsitemap files.; Disable or remove the plugin where business need is low.; Check vendor or archived project guidance for a supported update or replacement..

Prepared

Jun 29, 2026, 05:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.