CVE-2002-2235: Jelsoft vBulletin

Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days.

member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.

Affected products

• Jelsoft vBulletin: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.2.0 only; version 2.2.1 only; version 2.2.2 only; …

Published 2002-12-31. Last modified 2026-06-16.