CVE-2008-2744: vBulletin

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel (admincp/index.php).

Affected products

• vBulletin vBulletin: version 3.6.10 only; version 3.7.1 only

Published 2008-06-17. Last modified 2026-06-16.