CVE-2007-1292

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

CVE-2007-0869

Cross-site scripting XSS vulnerability in the Attachment Manager admincp/attachment.php in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field. NOTE: this might be a duplicate of CVE-2007-0830.5. NOTE: the provenance of this information i...

Cross site scripting

Cross-site scripting XSS vulnerability in the Attachment Manager admincp/attachment.php in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field. NOTE: this might be a duplicate of CVE-2007-0830.5. NOTE: the provenance of this information i...

CVE-2007-0869

Cross-site scripting XSS vulnerability in the Attachment Manager admincp/attachment.php in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field. NOTE: this might be a duplicate of CVE-2007-0830.5. NOTE: the provenance of this information i...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Admin Control Panel AdminCP in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the 1 User Group Manager, 2 User Rank Manager, 3 User Title Manager, ...

CVE-2007-0830

Multiple cross-site scripting XSS vulnerabilities in the Admin Control Panel AdminCP in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the 1 User Group Manager, 2 User Rank Manager, 3 User Title Manager, ...

CVE-2007-0830

Multiple cross-site scripting XSS vulnerabilities in the Admin Control Panel AdminCP in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the 1 User Group Manager, 2 User Rank Manager, 3 User Title Manager, ...

CVE-2007-0830

CVE-2007-0830 documents multiple XSS vulnerabilities in the Admin Control Panel of vBulletin 3.6.4. The issues allow remote authenticated administrators to inject arbitrary script/HTML via various AdminCP managers (User Group/Rank/Title, BB Code, Attachment, Calendar, Forums & Moderators). Vendor...

CVE-2006-6779

Cross-site scripting XSS vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript...

CVE-2006-6779

CVE-2006-6779 describes a Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin where remote attackers can inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript. The vulnerability is associated with vBulletin's SWF content and leads ...

CVE-2006-6779

Cross-site scripting XSS vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript...

CVE-2006-6040

CVE-2006-6040 affects Jelsoft vBulletin 3.6.x, specifically admincp/index.php. The vulnerability is due to cross-site scripting (XSS) via two parameters: prefs in a buildnavprefs action and navprefs in a savenavprefs action, enabling remote attackers to inject arbitrary script/HTML. Public refere...

CVE-2006-6040

Multiple cross-site scripting XSS vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via 1 the prefs parameter in a buildnavprefs action or 2 the navprefs parameter in a savenavprefs action...

CVE-2006-5104

SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter...

CVE-2006-5104

SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter...

CVE-2006-5104

The CVE-2006-5104 entry concerns Jelsoft vBulletin 2.x, where a SQL injection vulnerability exists in the global.php handling of the templatesused parameter. The underlying issue allows remote attackers to craft input that leads to arbitrary SQL execution, as reported in multiple sources (NVD ent...

CVE-2006-4271

PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the...

CVE-2006-4272

Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service resource consumption via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations...

CVE-2006-4271

PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the...

CVE-2006-4272

Jelsoft vBulletin 3.5.4 is affected: remote attackers can register multiple arbitrary users via the register.php endpoint, causing resource consumption/DoS. The issue is disputed by the vendor, who notes CAPTCHA can block registrations. Public details specify the vulnerability is triggered by a f...