[TheLastSuperman]

Well it all depends really, truly it does and that is sometimes the issue for some. So what you need to do is research about your host, it's not always about pricing and the cheapest the old saying holds true, you get what you pay for.

Attachments, if you allow .exe to be attached for example and they upload a virus named registry_cleaner_v1.exe and tell others it's a free registry cleaner and they download and install then yes in that instance otherwise no unless they have already gained access to your server and modified some of the files etc etc.

As for forum security... you can rename the admincp and modcp folders, install modifications against spam, use the search feature on vbulletin.com and here plus check out the Articles and other related forums on vb.com for more information there's tons of it or alternatively suhosin and more, picking and choosing what's best for you and least inconvenient for your members is what's key.