Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
JelsoftVbulletin

15 matches found

CVE
CVE•added 2007/03/07 12:19 a.m.•52 views

CVE-2007-1292

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almost...

7.5CVSS8AI score0.00901EPSS
CVE
CVE•added 2007/10/06 9:0 p.m.•46 views

CVE-2004-2695

SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the x_invoice_num parameter. NOTE: this issue might be related to CVE-2006-4267.

7.5CVSS8.2AI score0.01564EPSS
CVE
CVE•added 2007/03/21 9:19 p.m.•45 views

CVE-2007-1573

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field.

6CVSS7.8AI score0.00321EPSS
CVE
CVE•added 2007/02/07 10:28 p.m.•44 views

CVE-2007-0830

Multiple cross-site scripting (XSS) vulnerabilities in the Admin Control Panel (AdminCP) in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the (1) User Group Manager, (2) User Rank Manager, (3) User Title M...

3.5CVSS5.5AI score0.01005EPSS
CVE
CVE•added 2007/06/21 6:30 p.m.•40 views

CVE-2007-3326

Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a .. (dot dot) in (1) the loc parameter to admincp/index.php and (2) the Hyperlink information URl field for post Topic in showthread.php, enabling cross-site scr...

5.8CVSS5.9AI score0.00494EPSS
CVE
CVE•added 2007/08/01 4:17 p.m.•40 views

CVE-2007-4120

Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to includes/functions.php, the (2) nextitem parameter to includes/functions_cron.php, and the (3) specialtemplates parameter to...

9.3CVSS7.6AI score0.00847EPSS
CVE
CVE•added 2007/08/21 6:17 p.m.•40 views

CVE-2007-4453

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the (2) q parameter to (a) faq.php, (b) member.php, (c) memberlist.php, (d) calendar.php, (e) search.php, (f) forumdisplay.php...

4.3CVSS6.1AI score0.00253EPSS
CVE
CVE•added 2007/05/30 10:30 a.m.•39 views

CVE-2007-2908

Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action.

4.3CVSS5.7AI score0.06478EPSS
CVE
CVE•added 2007/05/30 10:30 a.m.•39 views

CVE-2007-2909

Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_calendar366_xss_fix_plugin.xml update.

3.5CVSS5.7AI score0.00172EPSS
CVE
CVE•added 2007/02/09 7:28 p.m.•36 views

CVE-2007-0869

Cross-site scripting (XSS) vulnerability in the Attachment Manager (admincp/attachment.php) in Jelsoft vBulletin 3.6.4 allows remote attackers to inject arbitrary web script or HTML via the Extension field. NOTE: this might be a duplicate of CVE-2007-0830.5. NOTE: the provenance of this information...

4.3CVSS5.4AI score0.003EPSS
CVE
CVE•added 2007/05/30 10:30 a.m.•36 views

CVE-2007-2911

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field (GPC['search']['datelineafter'] variable), a related issue to CVE-2007-1573.

8.5CVSS7.9AI score0.00389EPSS
CVE
CVE•added 2007/05/30 10:30 a.m.•35 views

CVE-2007-2910

Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_367_xss_fix_plugin.xml update, a related issue to CVE-2007-2909.

4.3CVSS5.8AI score0.00246EPSS
CVE
CVE•added 2007/05/30 10:30 a.m.•35 views

CVE-2007-2912

Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user.

5CVSS6.8AI score0.00332EPSS
CVE
CVE•added 2007/03/08 10:19 p.m.•33 views

CVE-2007-1342

Cross-site scripting (XSS) vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form.

4.3CVSS5.7AI score0.004EPSS
CVE
CVE•added 2007/10/14 8:0 p.m.•32 views

CVE-2002-2235

member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.

5CVSS6AI score0.00479EPSS