HTML disabled but forum allows Javascript

[Gabrielt]

Hello,

Our administrator found a potential security breach with vBulletin 3.8.7. Even though HTML code is disabled for messages, users can post Javascript code and the browser will interpret the Javascript code. We need to find a way to disable the insertion of Javascript code in messages. Any ideas?

Thanks,
Gabriel.

[Zachery]

Are you sure html is disabled? What is this javascript code that is getting though? Do you have any third party addons or modifications?

[Gabrielt]

Hello,

We found out that an advertisement script that is installed is the curlpit. With this script installed, the JavaScript code is run, with it disabled it isn't. So, it isn't a bug with vBulletin, but a bug with this particular advertisement script. I will contact the developer. Thank you for your attention.