EIP-2026-113026

The exploit demonstrates a reflected XSS vulnerability in vBulletin vBExperience 3.0 by injecting a malicious script via the 'sortorder' parameter in the URL. The lack of input sanitization allows arbitrary JavaScript execution in the context of the affected site.