CVE-2006-1040

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-03-07 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.

Affected products

Jelsoft Vbulletin: 3.0.12, 3.5.3

References

http://secunia.com/advisories/19100
http://www.kapda.ir/advisory-266.html
http://www.osvdb.org/23614
http://www.securityfocus.com/archive/1/426537/100/0/threaded
http://www.securityfocus.com/archive/1/426589/100/0/threaded
http://www.securityfocus.com/bid/16919
http://www.vbulletin.com/forum/showthread.php?postid=1079030
http://www.vupen.com/english/advisories/2006/0808
http://secunia.com/advisories/19100
http://www.kapda.ir/advisory-266.html
http://www.osvdb.org/23614
http://www.securityfocus.com/archive/1/426537/100/0/threaded

Get alerted when CVE-2006-1040 or the next vulnerability affects your stack