vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/