Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user.
Max CVSS
5.0
EPSS Score
0.41%
Published
2007-05-30
Updated
2008-11-15
SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field (GPC['search']['datelineafter'] variable), a related issue to CVE-2007-1573.
Max CVSS
8.5
EPSS Score
0.22%
Published
2007-05-30
Updated
2017-07-29
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_367_xss_fix_plugin.xml update, a related issue to CVE-2007-2909.
Max CVSS
4.3
EPSS Score
0.14%
Published
2007-05-30
Updated
2012-11-06
Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_calendar366_xss_fix_plugin.xml update.
Max CVSS
3.5
EPSS Score
0.07%
Published
2007-05-30
Updated
2012-11-06
Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action.
Max CVSS
4.3
EPSS Score
0.54%
Published
2007-05-30
Updated
2018-10-16
SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field.
Max CVSS
6.0
EPSS Score
0.10%
Published
2007-03-21
Updated
2018-10-16
Cross-site scripting (XSS) vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form.
Max CVSS
4.3
EPSS Score
0.36%
Published
2007-03-08
Updated
2018-10-16
SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almost impossible to achieve."
Max CVSS
7.5
EPSS Score
4.17%
Published
2007-03-07
Updated
2017-10-11
CVE-2005-0511
Public exploit
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
Max CVSS
7.5
EPSS Score
89.06%
Published
2005-02-21
Updated
2016-10-18
member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.
Max CVSS
5.0
EPSS Score
0.34%
Published
2002-12-31
Updated
2008-09-05
calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter.
Max CVSS
7.5
EPSS Score
1.22%
Published
2002-12-31
Updated
2017-07-11
index.php in Jelsoft vBulletin does not properly initialize a PHP variable that is used to store template information, which allows remote attackers to execute arbitrary PHP code via special characters in the templatecache parameter.
Max CVSS
7.5
EPSS Score
0.90%
Published
2001-06-27
Updated
2017-10-10
12 vulnerabilities found