CVE-2005-3020 Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect paramet...
MediumCVSS 4.3
EPSS 1.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect parameter to index.php, (3) email parameter to user.php, (4) goto parameter to language.php, (5) orderby parameter to modlog.php, and the (6) hex, (7) rgb, or (8) expandset parameter to template.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jelsoft vbulletin | = 1.0.1 | No fix listed |
| jelsoft vbulletin | = 2.0.3 | No fix listed |
| jelsoft vbulletin | = 2.0_rc2 | No fix listed |
| jelsoft vbulletin | = 2.0_rc3 | No fix listed |
| jelsoft vbulletin | = 2.2.0 | No fix listed |
| jelsoft vbulletin | = 2.2.1 | No fix listed |
| jelsoft vbulletin | = 2.2.2 | No fix listed |
| jelsoft vbulletin | = 2.2.3 | No fix listed |
| jelsoft vbulletin | = 2.2.4 | No fix listed |
| jelsoft vbulletin | = 2.2.5 | No fix listed |
| jelsoft vbulletin | = 2.2.6 | No fix listed |
| jelsoft vbulletin | = 2.2.7 | No fix listed |
| jelsoft vbulletin | = 2.2.8 | No fix listed |
| jelsoft vbulletin | = 2.2.9 | No fix listed |
| jelsoft vbulletin | = 2.3.0 | No fix listed |
| jelsoft vbulletin | = 2.3.2 | No fix listed |
| jelsoft vbulletin | = 2.3.3 | No fix listed |
| jelsoft vbulletin | = 2.3.4 | No fix listed |
| jelsoft vbulletin | = 3.0 | No fix listed |
| jelsoft vbulletin | = 3.0.1 | No fix listed |
| jelsoft vbulletin | = 3.0.2 | No fix listed |
| jelsoft vbulletin | = 3.0.3 | No fix listed |
| jelsoft vbulletin | = 3.0.4 | No fix listed |
| jelsoft vbulletin | = 3.0.5 | No fix listed |
| jelsoft vbulletin | = 3.0.6 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| jelsoft vbulletin | = 3.0.7 | No fix listed |
| jelsoft vbulletin | = 3.0.8 | No fix listed |
| jelsoft vbulletin | = 3.0.9 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_2 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_3 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_4 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_5 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_6 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_7 | No fix listed |
| jelsoft vbulletin | = 3.0_gamma | No fix listed |
References
- 20050918 [BuHa-Security] Multiple vulnerabilities in (admincp/modcp of) mailing-list
- morph3us.org exploit patch vendor-advisory
- 16873 patch third-party-advisory vendor-advisory
- 14874 exploit patch vdb-entry
- vbulletin-xss(22324) vdb-entry