CVE-2020-25118: 
VBulletin vulnerability analysis and mitigation

The Admin CP in vBulletin 5.6.3 allows Cross-Site Scripting (XSS) via a Style Options Settings Title to Styles Manager. This vulnerability was disclosed on September 3, 2020, and has been assigned identifier CVE-2020-25118 (NVD).

The vulnerability has been assessed with a CVSS v3.1 Base Score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 score is 3.5 (LOW) with vector (AV:N/AC:M/Au:S/C:N/I:P/A:N). This indicates that the vulnerability requires high privileges and user interaction to exploit (NVD).

If successfully exploited, this XSS vulnerability could allow attackers to inject malicious web scripts or HTML via the Style Options Settings Title in the Styles Manager section of the Admin Control Panel. This could potentially lead to the execution of arbitrary web scripts in the context of the affected user's browser (NVD).

The vulnerability requires high privileges (administrative access) and user interaction to exploit. It has been classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

Users should upgrade to a patched version of vBulletin as recommended by the vendor. As this is a high-privilege vulnerability affecting the Admin Control Panel, access to administrative functions should be strictly controlled (NVD).