CVE-2006-3253: XSS
DISPUTED Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3253?
The severity of CVE-2006-3253 is generally considered to be moderate due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2006-3253?
To fix CVE-2006-3253, it is recommended to upgrade to a patched version of vBulletin that addresses this vulnerability.
What versions of vBulletin are affected by CVE-2006-3253?
CVE-2006-3253 affects vBulletin versions 3.5.0 to 3.5.3, along with several beta and release candidate versions.
What type of attacks can exploit CVE-2006-3253?
CVE-2006-3253 can be exploited through XSS attacks, allowing attackers to inject malicious scripts or HTML onto affected web pages.
Does the vendor acknowledge the existence of CVE-2006-3253?
The vendor has disputed the existence of CVE-2006-3253, stating they have been unable to replicate the issue.