CVE-2004-2288

vBulletin - Cross-Site Scripting via index.php loc Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2288. PoCs published by p0rk.

AI-analyzed exploit summary This is a writeup describing a vulnerability in VBulletin where improper validation of user-supplied data allows an attacker to spoof parts of the VBulletin interface by convincing an administrator to follow a crafted URI.

Description

Cross-site scripting (XSS) vulnerability in index.php in Jelsoft vBulletin allows remote attackers to spoof parts of a website via the loc parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by p0rk · textwebappsphp
https://www.exploit-db.com/exploits/24124

This is a writeup describing a vulnerability in VBulletin where improper validation of user-supplied data allows an attacker to spoof parts of the VBulletin interface by convincing an administrator to follow a crafted URI.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: VBulletin
No auth needed
Prerequisites: An administrator to follow a crafted URI
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/10362

Scores

EPSS 0.0138
EPSS Percentile 69.2%

Details

Status published
Products (25)
jelsoft/vbulletin 1.0.1
jelsoft/vbulletin 2.0.3
jelsoft/vbulletin 2.0_rc2
jelsoft/vbulletin 2.0_rc3
jelsoft/vbulletin 2.2.0
jelsoft/vbulletin 2.2.1
jelsoft/vbulletin 2.2.2
jelsoft/vbulletin 2.2.3
jelsoft/vbulletin 2.2.4
jelsoft/vbulletin 2.2.5
... and 15 more
Published Dec 31, 2004
Tracked Since Feb 18, 2026