CVE-2008-2744: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel admincp/index.php...

CVE-2007-1342: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form...

CVE-2006-6040: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via 1 the prefs parameter in a buildnavprefs action or 2 the navprefs parameter in a savenavprefs action...