Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action.Referenceshttp://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441
