CVE-2011-5251

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-12-31 · updated 2026-06-16
Weakness: CWE-20

Description

Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action.

Affected products

vBulletin: through 4.1.3; 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+6)

References

http://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441
http://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441

Get alerted when CVE-2011-5251 or the next vulnerability affects your stack