Description
Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by CrAzY.CrAcKeR · textwebappsphp
https://www.exploit-db.com/exploits/28076
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/27508
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/437817/100/0/threaded
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/1155
Exploit vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1016348
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27261
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/438364/100/100/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/18551
Scores
EPSS
0.0746
EPSS Percentile
91.8%
Details
Status
published
Products (11)
jelsoft/vbulletin
3.5.0
jelsoft/vbulletin
3.5.0_beta_1
jelsoft/vbulletin
3.5.0_beta_2
jelsoft/vbulletin
3.5.0_beta_3
jelsoft/vbulletin
3.5.0_beta_4
jelsoft/vbulletin
3.5.0_rc1
jelsoft/vbulletin
3.5.0_rc2
jelsoft/vbulletin
3.5.0_rc3
jelsoft/vbulletin
3.5.1
jelsoft/vbulletin
3.5.2
... and 1 more
Published
Jun 28, 2006
Tracked Since
Feb 18, 2026