EIP-2026-112984

The writeup describes a cross-site scripting (XSS) vulnerability in vBulletin's 'private.php' script due to insufficient input sanitization. The issue allows injection of malicious script code via the 'forward' parameter, potentially leading to credential theft or other client-side attacks.