CVE-2020-25121

Affected software: vBulletin 5.6.3 Admin CP. Vulnerability: cross-site scripting (XSS) via the Paid Subscription Email Notification field in the Options. Root cause: input in that field is not properly sanitized, enabling injection in the Admin CP context. Impact: XSS could affect authenticated a...

CVE-2020-25121

The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options...

CVE-2020-25122

The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager...

CVE-2020-25122

CVE-2020-25122 affects the Admin CP of vBulletin 5.6.3 . The vulnerability is an XSS via a Rank Type to the User Rank Manager . According to CVSS data in the sources, the issue has a Network attack vector with Medium to Low impact depending on the metric (CVSS 3.1: base score 4.8, MEDIUM, require...

CVE-2020-25123

CVE-2020-25123 affects vBulletin 5.6.3: the Admin CP is vulnerable to cross-site scripting via the Smilie Title field in the Smilies Manager. The root cause, as described in the provided documents, is insufficient escaping/validation of the Smilie Title input, allowing injected script when the Sm...

CVE-2020-25124

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...

PT-2020-15963

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via a Smilie Title to Smilies Manager. Recommendations For version 5.6.3, update to a newer version that contains a fix for...

CVE-2020-25119: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual...

CVE-2020-25115: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...

PT-2020-15964

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via a specific URI, admincp/attachment.php&do=rebuild&type=. Recommendations For version 5.6.3, consider restricting access t...

PT-2020-15956

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue concerns an XSS vulnerability in the Admin CP of vBulletin, specifically via an Announcement Title to Channel Manager. Recommendations For version 5.6.3, consider disabling the Announcement Title...

PT-2020-15961

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue concerns a problem with the Admin CP in vBulletin, where an XSS attack can be performed via the Paid Subscription Email Notification field in the Options. Recommendations For vBulletin version 5.6....

PT-2020-15962

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue concerns a Cross-Site Scripting XSS flaw in the Admin CP of the affected software. Specifically, the vulnerability can be triggered via a Rank Type in the User Rank Manager. Recommendations For...

CVE-2020-25117: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager...

PT-2020-15960

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via the admincp/search.php?do=dosearch URI. Recommendations For version 5.6.3, consider restricting access to the...

PT-2020-15959

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue concerns a Cross-Site Scripting XSS flaw in the Admin CP of the affected software. Specifically, it can be triggered via the Title of a Child Help Item in the Login/Logoff section of the User Manua...

PT-2020-15955

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via an Occupation Title or Description to the User Profile Field Manager. Recommendations For version 5.6.3, consider disabli...

PT-2020-15957

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue allows for XSS via a Junior Member Title to User Title Manager in the Admin CP. Recommendations For version 5.6.3, update to a newer version that contains a fix for this issue...

CVE-2020-25118: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager...

PT-2020-15958

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue concerns a problem with the Admin CP in vBulletin, where an XSS attack can be performed via a Style Options Settings Title to Styles Manager. Recommendations For version 5.6.3, update to a newer...