Unrated severityNVD Advisory· Published Mar 7, 2006· Updated Jun 16, 2026

CVE-2006-1040

Description

Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jelsoft/Vbulletin3 versions
cpe:2.3:a:jelsoft:vbulletin:3.0.12:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:jelsoft:vbulletin:3.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:jelsoft:vbulletin:3.5.3:*:*:*:*:*:*:*
- (no CPE)range: 3.0.12, 3.5.3

Patches

Vulnerability mechanics

References

www.kapda.ir/advisory-266.htmlnvdExploitPatchVendor Advisory
secunia.com/advisories/19100nvd
www.osvdb.org/23614nvd
www.securityfocus.com/archive/1/426537/100/0/threadednvd
www.securityfocus.com/archive/1/426589/100/0/threadednvd
www.securityfocus.com/bid/16919nvd
www.vbulletin.com/forum/showthread.phpnvd
www.vupen.com/english/advisories/2006/0808nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000