GCVE - cpe:2.3:a:jelsoft:vbulletin:3.5.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jelsoft:vbulletin:3.5.1:*:*:*:*:*:*:*

part: a version: 3.5.1 update: *

Vendor	Jelsoft (`a1aea8a5-a68d-5cee-b31b-dd71f1d6156f`)
Product	Vbulletin (`6a9e181e-ed68-5b6f-87bf-8f1b3f688bbc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2006-6779`	vulnerable	2026-06-08 04:49:29.726716	Details available Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript. Published: 2006-12-28T00:00:00.000Z Updated: 2024-08-07T20:42:06.520Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/455265/100/0/threaded http://www.securityfocus.com/bid/21736 http://www.securityfocus.com/archive/1/455351/100/0/threaded http://securityreason.com/securityalert/2084 http://www.securityfocus.com/archive/1/455414/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-3253`	vulnerable	2026-06-08 04:49:08.720034	Details available Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer. Published: 2006-06-27T19:00:00.000Z Updated: 2024-08-07T18:23:21.203Z Open on db.gcve.eu Reference links http://www.osvdb.org/27508 http://www.securityfocus.com/archive/1/437817/100/0/threaded http://securityreason.com/securityalert/1155 http://securitytracker.com/id?1016348 https://exchange.xforce.ibmcloud.com/vulnerabilities/27261	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-1816`	vulnerable	2026-06-08 04:48:58.089117	Details available PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php, and (3) ImpExDisplay.php. Published: 2006-04-18T10:00:00.000Z Updated: 2024-08-07T17:27:28.858Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/467666/100/0/threaded http://www.securityfocus.com/archive/1/430881/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/34095 http://secunia.com/advisories/19352 https://exchange.xforce.ibmcloud.com/vulnerabilities/25789	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4621`	vulnerable	2026-06-08 04:48:44.475828	Details available Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension such as .jpg. Published: 2006-01-06T11:00:00.000Z Updated: 2024-08-07T23:53:28.150Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/16128 http://www.osvdb.org/21373 http://www.vbulletin.com/forum/showthread.php?t=166391 http://pridels0.blogspot.com/2005/11/vbulletin-351-xss-vuln.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.