CVE-2020-25121: XSS
First published: Thu Sep 03 2020(Updated: )
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| vBulletin vBulletin | =5.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-25121?
CVE-2020-25121 is a vulnerability in the Admin CP of vBulletin 5.6.3 that allows XSS via the Paid Subscription Email Notification field in the Options.
What software versions are affected by CVE-2020-25121?
vBulletin version 5.6.3 is affected by CVE-2020-25121.
What is the severity of CVE-2020-25121?
CVE-2020-25121 has a severity keyword of 'medium' and a severity value of 4.8.
What is the Common Weakness Enumeration (CWE) ID of CVE-2020-25121?
CVE-2020-25121 is associated with CWE-79, which is the Weakness ID for Cross-Site Scripting (XSS).
How can I fix CVE-2020-25121?
To fix CVE-2020-25121, upgrade vBulletin to a version that includes a patch for this vulnerability.
- collector/nvd-index
- vendor/vbulletin
- canonical/vbulletin vbulletin
- version/vbulletin vbulletin/5.6.3