Login Request a demo
Unscored severity · published Jun 28, 2006
CVE-2006-3253
Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter
–
CVSS
2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VB
Vbulletin · Jelsoft
3.5.0; 3.5.0_beta_1; 3.5.0_beta_2; 3.5.0_beta_3; 3.5.0_beta_4; 3.5.0_rc1; +5 more · source: NVD
Affected product
VB
Vbulletin
Jelsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3253
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3253
securityreason.com
http://securityreason.com/securityalert/1155
Exploit
http://securitytracker.com/id?1016348
www.osvdb.org
http://www.osvdb.org/27508
www.securityfocus.com
http://www.securityfocus.com/archive/1/437817/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/438364/100/100/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/18551
More from Vbulletin
–
CVE-2007-4453
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the…
–
CVE-2007-4120
Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to…
–
CVE-2007-3326
Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a
–
CVE-2007-2910
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to…
–
CVE-2007-2908
Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a…