vBulletin version 3.6.4 is susceptible to cross site scripting flaws in multiple functions in index.php.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/54253/vbulletin364-xss.txt
Source: https://packetstormsecurity.com/files/54253/vbulletin364-xss.txt.html