Unscored severity · published Feb 17, 2004
CVE-2004-0091
NOTE: this issue has been disputed by the vendor
–
CVSS
1.2%
EPSS
No
On KEV
Description
NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in register.php for unknown versions of vBulletin allows remote attackers to inject arbitrary HTML or web script via the reg_site (or possibly regsite) parameter. NOTE: the vendor has disputed this issue, saying "There is no hidden field called 'reg_site', nor any $reg_site variable anywhere in the vBulletin 2 or vBulletin 3 source code or templates, nor has it ever existed. We can only assume that this vulnerability was found in a site running code modified from that supplied by Jelsoft.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VB
Vbulletin · Jelsoft
3.0_beta_2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0091
marc.info
http://marc.info/?l=bugtraq&m=107462349324945&w=2
marc.info
http://marc.info/?l=vuln-dev&m=107462499927040&w=2
marc.info
http://marc.info/?l=vuln-dev&m=107478592401619&w=2
marc.info
http://marc.info/?l=vuln-dev&m=107488880317647&w=2
securitytracker.com
http://securitytracker.com/id?1008780
More from Vbulletin
–
CVE-2007-4453
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the…
–
CVE-2007-4120
Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to…
–
CVE-2007-3326
Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a
–
CVE-2007-2910
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to…
–
CVE-2007-2908
Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a…