CVE-2012-6670 Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the re...
MediumCVSS 6.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in (1) actions/nominatemedal.php or (2) actions/requestmedal.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dragonbyte-tech vbactivity module | < 3.0.1 | 3.0.1 |
References
- 48490 permissions-required third-party-advisory
- www.dragonbyte-tech.com patch vendor-advisory
- 52711 third-party-advisory vdb-entry
- vbulletin-vbactivity-reason-xss(74346) vdb-entry