Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.
References
Configurations
Configuration 1 (hide)
|
Information
Published : 2014-10-24 17:55
Updated : 2017-08-28 18:34
NVD link : CVE-2014-2021
Mitre link : CVE-2014-2021
JSON object : View
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Products Affected
vbulletin
- vbulletin