CVE-2004-1515

SQL injection vulnerability in 1 ttlast.php and 2 last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as demonstrated using last.php...

CVE-2004-1824

Cross-site scripting XSS vulnerability in Jelsoft vBulletin before 3.0 allows remote attackers to inject arbitrary web script or HTML via the what parameter to memberlist.php...

CVE-2004-2076

Cross-site scripting XSS vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2004-0620

Cross-site scripting XSS vulnerability in 1 newreply.php or 2 newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script as other users via the Edit-panel...

vBulletin - LAST.php SQL Injection

vBulletin - LAST.php SQL Injection Example: http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201 milw0rm.com 2004-11-15...

vBulletin LAST.PHP SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================== vBulletin LAST.PHP SQL Injection Vulnerability ============================================== Example:...

vBulletin - 'LAST.php' SQL Injection

Example: http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201 milw0rm.com 2004-11-15...

vBulletin LAST.PHP SQL Injection Vulnerability

No description provided by source. Example: http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201 milw0rm.com 2004-11-15...

Vulnerability not with vBulletin

The vulnerability listed here is in a third-party 'hack' script, which is not part of vBulletin itself, and is beyond the control of the vBulletin developers. Kier Darby Product Manager, vBulletin From: "Dr. Death" To: [email protected] Subject: SQL injection in vBulletin forums last10.ph...

SQL injection in vBulletin forums (last10.php)

hi all, a new SQL injection found in VBulletin Forums 3.0.x the Vulnerabilite found in last.php, last 10 topics hack. last.php?fsel=,user.password20as20title,user.20 202020username20as20lastposter20FROM20user, thread2020202020WHERE20usergroupid=620LIMIT 201 to solve the problem delet fsel? from...

vbul30x.txt

hi all, a new SQL injection found in VBulletin Forums 3.0.x the Vulnerabilite found in last.php, last 10 topics hack. last.php?fsel=,user.password%20as%20title,user.%20 %20%20%20username%20as%20lastposter%20FROM%20user, thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT %201 to solve the problem...

vBulletin memberlist.php what Parameter XSS

The remote version of vBulletin is vulnerable to a cross-site scripting issue due to a failure of the application to properly sanitize user-supplied URI input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be...

vBulletin newreply.php WYSIWYG_HTML Parameter XSS

According to its banner, the remote version of vBulletin is vulnerable to a cross-site scripting issue, due to a failure of the application to properly sanitize user-supplied input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing scrip...

vBulletin authorize.php x_invoice_num Parameter SQL Injection

According to its banner, the remote version of vBulletin is vulnerable to a SQL injection issue. It is reported that versions 3.0.0 through to 3.0.3 are prone to this issue. An attacker may exploit this flaw to gain the control of the remote database. %NASLMINLEVEL 70300 C Tenable Network Securit...

vBulletin authorize.php x_invoice_num Parameter SQL Injection

Binary data 2294.prm...

[UNIX] vBulletin SQL Injection While Verifying Subscription Information

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2004-0036

SQL injection vulnerability in calendar.php for vBulletin Forum 2.3.x before 2.3.4 allows remote attackers to steal sensitive information via the eventid parameter...

CVE-2004-0036

CVE-2004-0036 describes a SQL injection in calendar.php for vBulletin Forum 2.3.x before 2.3.4, exploitable via the eventid parameter to exfiltrate data. Affected component is the calendar feature in vBulletin 2.3.x; root cause is improper input handling in eventid. Impact stated: attackers can s...

CVE-2004-0620

Cross-site scripting XSS vulnerability in 1 newreply.php or 2 newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script as other users via the Edit-panel...

CVE-2004-0620

The CVE-2004-0620 issue affects vBulletin versions around 3.0.1, where the XSS flaw exists in the newreply.php and newthread.php code (Edit-panel) that allows a remote attacker to inject HTML/script as another user. OpenVAS entries frame this as a vulnerability in vBulletin