CVE-2006-2335: Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows r...

Security readout for executives and security teams

This CVE describes a reported vBulletin issue where an authenticated administrator could upload a CSS file that is later processed in a way that may execute PHP code. That could turn forum administration access into server-level compromise, but the record notes the vendor could not reproduce it in vBulletin 3.5.x. Exposure is most plausible on legacy Jelsoft vBulletin deployments with administrator access to style or CSS upload features. The source bundle does not identify confirmed affected versions, CPEs, or fixed releases. Treat this as a legacy-platform risk requiring inventory and access review. Prioritize if vBulletin is internet-facing, unsupported, or broadly administered; evidence is too incomplete to justify claims of current widespread exploitation. Mitigation focus: Check vendor guidance for the exact vBulletin version before assuming a patch exists.; Restrict forum administrator access to trusted users and protected networks.; Review and reduce permissions for style, template, and CSS upload workflows..

Prepared

Jun 29, 2026, 12:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.