CVE-2006-2335

CVE-2006-2335 is a medium-severity vulnerability in Jelsoft Vbulletin with a CVSS 2.0 base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed. NOTE: the vendor was unable to reproduce this issue in 3.5.x. NOTE: this issue might be due to direct static code injection.

Frequently asked questions

What is CVE-2006-2335?
Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed. NOTE: the vendor was unable to reproduce this issue in 3.5.x. NOTE: this issue might be due to direct static code injection.
How severe is CVE-2006-2335?
CVE-2006-2335 has a CVSS 2.0 base score of 6.5, rated medium severity.
Is CVE-2006-2335 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-2335?
CVE-2006-2335 affects Jelsoft Vbulletin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2006-2335?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-2335 published?
CVE-2006-2335 was published on 2006-05-12 and last updated on 2026-06-16.

References

Affected products (1)

More vulnerabilities in Jelsoft Vbulletin

All CVEs affecting Jelsoft Vbulletin →