Vulnerability Report

CVE-2002-2235

Title: vBulletin XSS via $perpage variable

XSS

Proof Of Concept

PoC Available for CVE-2002-2235

CWE Category CWE-189

Published Date Dec 31, 2002

Modified Date Jun 16, 2026

Exploit Status Available

Score 5.0 CVSS v2.0

Exploit Probability (EPSS)

2.06%

Vulnerability Summary

CVE-2002-2235: member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.

Impacted Vendors

jelsoft 1

vbulletin 1

Reference Links

http://online.securityfocus.com/archive/1/301076 http://securityreason.com/securityalert/3229 http://www.iss.net/security_center/static/10701.php http://www.securityfocus.com/bid/6246 http://online.securityfocus.com/archive/1/301076 http://securityreason.com/securityalert/3229 http://www.iss.net/security_center/static/10701.php http://www.securityfocus.com/bid/6246

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2002-2235 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/22042

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 03, 2025 MODIFIED

Vulnerability data or affected products updated.

December 31, 2002 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected Stack

No specific products linked.