CVE-2007-2909: Jelsoft vBulletin

Low severity, CVSS 3.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_calendar366_xss_fix_plugin.xml update.

Affected products

• Jelsoft vBulletin: up to and including 3.6.6

Published 2007-05-30. Last modified 2026-06-16.