CVE-2005-4621

Published: Dec 31, 2005Modified: Apr 16, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension such as .jpg.

Affected (38)

Products: Jelsoft: Vbulletin

Jelsoft

1 product

Vbulletin

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Jelsoft Vbulletin	Version 1.0.1
Jelsoft Vbulletin	Version 2.0.3
Jelsoft Vbulletin	Version 2.0_rc2
Jelsoft Vbulletin	Version 2.0_rc3
Jelsoft Vbulletin	Version 2.2.0
Jelsoft Vbulletin	Version 2.2.1
Jelsoft Vbulletin	Version 2.2.2
Jelsoft Vbulletin	Version 2.2.3
Jelsoft Vbulletin	Version 2.2.4
Jelsoft Vbulletin	Version 2.2.5
Jelsoft Vbulletin	Version 2.2.6
Jelsoft Vbulletin	Version 2.2.7
Jelsoft Vbulletin	Version 2.2.8
Jelsoft Vbulletin	Version 2.2.9
Jelsoft Vbulletin	Version 2.3.0
Jelsoft Vbulletin	Version 2.3.2
Jelsoft Vbulletin	Version 2.3.3
Jelsoft Vbulletin	Version 2.3.4
Jelsoft Vbulletin	Version 2.3.8
Jelsoft Vbulletin	Version 3.0.10
Jelsoft Vbulletin	Version 3.0.1
Jelsoft Vbulletin	Version 3.0.2
Jelsoft Vbulletin	Version 3.0.3
Jelsoft Vbulletin	Version 3.0.4
Jelsoft Vbulletin	Version 3.0.5
Jelsoft Vbulletin	Version 3.0.6
Jelsoft Vbulletin	Version 3.0.7
Jelsoft Vbulletin	Version 3.0.8
Jelsoft Vbulletin	Version 3.0.9
Jelsoft Vbulletin	Version 3.0
Jelsoft Vbulletin	Version 3.0_beta_2
Jelsoft Vbulletin	Version 3.0_beta_3
Jelsoft Vbulletin	Version 3.0_beta_4
Jelsoft Vbulletin	Version 3.0_beta_5
Jelsoft Vbulletin	Version 3.0_beta_6
Jelsoft Vbulletin	Version 3.0_beta_7
Jelsoft Vbulletin	Version 3.0_gamma
Jelsoft Vbulletin	Version 3.5.1