CVE-2008-3184

Published: Jul 15, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO (PHP_SELF) or (2) the do parameter, as demonstrated by requests to upload/admincp/faq.php. NOTE: this issue can be leveraged to execute arbitrary PHP code.

Affected (17)

Products: Vbulletin: Vbulletin

Vbulletin

1 product

Vbulletin

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Vbulletin Vbulletin	Version 3.6.10
Vbulletin Vbulletin	Version 3.6.10 pl1
Vbulletin Vbulletin	Version 3.6.1
Vbulletin Vbulletin	Version 3.6.2
Vbulletin Vbulletin	Version 3.6.3
Vbulletin Vbulletin	Version 3.6.4
Vbulletin Vbulletin	Version 3.6.5
Vbulletin Vbulletin	Version 3.6.6
Vbulletin Vbulletin	Version 3.6.7
Vbulletin Vbulletin	Version 3.6.8
Vbulletin Vbulletin	Version 3.6.9
Vbulletin Vbulletin	Version 3.6
Vbulletin Vbulletin	Version 3.7.0
Vbulletin Vbulletin	Version 3.7.1
Vbulletin Vbulletin	Version 3.7.1 gold
Vbulletin Vbulletin	Version 3.7.1 pl1
Vbulletin Vbulletin	Version 3.7.2