CVE-2006-0080

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-01-04 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by (1) calendar.php and (2) reminder.php.

Affected products

Jelsoft Vbulletin: 3.5.2

References

http://kapda.ir/advisory-177.html
http://secunia.com/advisories/18299
http://www.osvdb.org/22210
http://www.osvdb.org/22220
http://www.securityfocus.com/archive/1/420663/100/0/threaded
http://www.securityfocus.com/archive/1/421310/100/0/threaded
http://www.securityfocus.com/bid/16116
http://www.vupen.com/english/advisories/2006/0033
http://kapda.ir/advisory-177.html
http://secunia.com/advisories/18299
http://www.osvdb.org/22210
http://www.osvdb.org/22220

Get alerted when CVE-2006-0080 or the next vulnerability affects your stack