The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.
vbulletin vbulletin 5.6.3