CVE-2006-1040

medium

Description

Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.

References

http://www.vupen.com/english/advisories/2006/0808

http://www.vbulletin.com/forum/showthread.php?postid=1079030

http://www.securityfocus.com/bid/16919

http://www.securityfocus.com/archive/1/426589/100/0/threaded

http://www.securityfocus.com/archive/1/426537/100/0/threaded

http://www.osvdb.org/23614

http://secunia.com/advisories/19100

Details

Source: Mitre, NVD

Published: 2006-03-07

Updated: 2025-04-03

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N