CVE-2002-2235

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2002-12-31 · updated 2026-06-16
Weakness: CWE-189

Description

member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.

Affected products

Jelsoft Vbulletin: 2.0, 2.0.1, 2.0.2, 2.2.0, 2.2.1, 2.2.2 (+8)

References

http://online.securityfocus.com/archive/1/301076
http://securityreason.com/securityalert/3229
http://www.iss.net/security_center/static/10701.php
http://www.securityfocus.com/bid/6246
http://online.securityfocus.com/archive/1/301076
http://securityreason.com/securityalert/3229
http://www.iss.net/security_center/static/10701.php
http://www.securityfocus.com/bid/6246

Get alerted when CVE-2002-2235 or the next vulnerability affects your stack