PT-2020-15964

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via a specific URI, admincp/attachment.php&do=rebuild&type=. Recommendations For version 5.6.3, consider restricting access t...

CVE-2020-25124: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...

CVE-2007-2911: Undefined Security Weakness

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field GPC'search''datelineafter' variable, a related issue to CVE-2007-1573...

Sql injection

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-1573: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-0869: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Attachment Manager admincp/attachment.php in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field. NOTE: this might be a duplicate of CVE-2007-0830.5. NOTE: the provenance of this information i...