Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-3135: vBulletin lets attackers insert malicious script into messages

CVE-2014-3135 · published 12 years ago

Summary

The forum software vBulletin version 5.1.1 Alpha 9 can be tricked into adding hidden code to private messages, help pages, and topic views. When a user opens the affected page, the hidden code runs in their browser, which could steal information or hijack the session. Update to the latest vBulletin release or apply the vendor’s patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
vbulletin	vbulletin	5.1.1 `cpe:2.3:a:vbulletin:vbulletin:5.1.1:alpha9::::::`

Original advisory text

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published30 Apr 2014

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2014-3135 · NVD

Track software like this

Free during beta