VDB
CVE-2008-3664
CVE-2008-3664
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via (1) the real name field, related to the user list; (2) the target parameter to login.php, (3) the title parameter to activities/some.php, (4) the company_name parameter to companies/some.php, (5) the last_name parameter to contacts/some.php, (6) the campaign_title parameter to campaigns/some.php, (7) the opportunity_title parameter to opportunities/some.php, (8) the case_title parameter to cases/some.php, (9) the file_id parameter to files/some.php, or (10) the starting parameter to reports/custom/mileage.php, a related issue to CVE-2008-1129.
EPSS 0.42% · 62.2th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
0.42%
62.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| xrms | xrms_crm | |
| n/a | n/a | n/a |
Timeline
- Sep 4, 2008 PoC Published
- Sep 5, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
References
- 20080904 Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities in XRMS, CVE-2008-3664 mailing-list
- 4229 third-party-advisory
- xrms-login-some-mileage-xss(45142) vdb
- 31008 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2008-3664 advisory