CVE-2020-25120: 
VBulletin vulnerability analysis and mitigation

The Admin CP in vBulletin 5.6.3 allows Cross-Site Scripting (XSS) via the admincp/search.php?do=dosearch URI (NVD). This vulnerability was disclosed on September 3, 2020.

The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

If exploited, this XSS vulnerability could allow attackers to execute arbitrary web scripts in the context of the admin control panel. This could lead to theft of sensitive information, session hijacking, or other malicious actions with administrator privileges (NVD).

The vulnerability requires high privileges (administrator access) and user interaction to be exploited. The attack complexity is low, meaning once the prerequisites are met, the attack is relatively straightforward to execute (NVD).

Users should upgrade to a patched version of vBulletin that addresses this vulnerability. As this is a stored XSS vulnerability in the admin control panel, administrators should be cautious when using the search functionality until the patch is applied (NVD).