CVE-2006-3253

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-06-28 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.

Affected products

Jelsoft Vbulletin: 3.5.0, 3.5.0_beta_1, 3.5.0_beta_2, 3.5.0_beta_3, 3.5.0_beta_4, 3.5.0_rc1 (+5)

References

http://securityreason.com/securityalert/1155
http://securitytracker.com/id?1016348
http://www.osvdb.org/27508
http://www.securityfocus.com/archive/1/437817/100/0/threaded
http://www.securityfocus.com/archive/1/438364/100/100/threaded
http://www.securityfocus.com/bid/18551
https://exchange.xforce.ibmcloud.com/vulnerabilities/27261
http://securityreason.com/securityalert/1155
http://securitytracker.com/id?1016348
http://www.osvdb.org/27508
http://www.securityfocus.com/archive/1/437817/100/0/threaded
http://www.securityfocus.com/archive/1/438364/100/100/threaded

Get alerted when CVE-2006-3253 or the next vulnerability affects your stack