A flaw was identified in the Login component of vBulletin 6.x that allows an attacker to inject and execute malicious script code through a manipulated input. The vulnerability is a reflected cross‑site scripting (XSS) exploit, which can be triggered remotely without authentication. Successful exploitation would enable an attacker to run arbitrary client‑side code in the context of a victim’s browser session, potentially compromising user credentials, session cookies, and the integrity of data viewed by that user.

The affected product is vBulletin 6.x. No specific sub‑versions are listed in the advisory, but any instance of vBulletin 6.x that has not applied a patch or update is considered vulnerable.

The CVSS score of 5.1 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can launch the exploit remotely by manipulating input parameters to the Login page. Since the vendor has not yet responded with a patch, users rely on mitigations or updates from later releases to reduce the attack surface.