CVE-2008-1873 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 1.5% (pctl 74)
Patch early
A public exploit exists.
Description
Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of these details are obtained from third party information.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 1.5% — more likely to be exploited than 74% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-04-17 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| microsoft | internet explorer |
| tru-zone | nukeet |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Nuke ET 3.4 - 'mensaje' HTML Injection | 2008-04-04 |
References
- http://mrzayas.es/wp-content/poc/nukeet.txt
- http://secunia.com/advisories/29651
- http://www.mrzayas.es/2008/04/04/xploitnukeet3/
- http://www.securityfocus.com/bid/28614
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41646
- http://mrzayas.es/wp-content/poc/nukeet.txt
- http://secunia.com/advisories/29651
- http://www.mrzayas.es/2008/04/04/xploitnukeet3/
- http://www.securityfocus.com/bid/28614
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41646
→ the Explorer · watch your stack · NVD