CVEvulnerability

CVE-2008-3184

4.3 MEDIUM Published 2008-07-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-07-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO (PHP_SELF) or (2) the do parameter, as demonstrated by requests to upload/admincp/faq.php. NOTE: this issue can be leveraged to execute arbitrary PHP code.

Affected configurations

• vbulletin vbulletin 3.6 • vbulletin vbulletin 3.6.1 • vbulletin vbulletin 3.6.2 • vbulletin vbulletin 3.6.3 • vbulletin vbulletin 3.6.4 • vbulletin vbulletin 3.6.5 • vbulletin vbulletin 3.6.6 • vbulletin vbulletin 3.6.7 • vbulletin vbulletin 3.6.8 • vbulletin vbulletin 3.6.9 • vbulletin vbulletin 3.6.10 • vbulletin vbulletin 3.7.0 • vbulletin vbulletin 3.7.1 • vbulletin vbulletin 3.7.2

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References