CVE-2006-3253: Jelsoft vBulletin

Low severity, CVSS 2.6. EPSS: 2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.

Affected products

• Jelsoft vBulletin: version 3.5.0 only; version 3.5.0_beta_1 only; version 3.5.0_beta_2 only; version 3.5.0_beta_3 only; version 3.5.0_beta_4 only; version 3.5.0_rc1 only; …

Published 2006-06-28. Last modified 2026-06-16.