peter bassill · operator
$ cve CVE-2008-3101 JSON

CVE-2008-3101 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 3.8% (pctl 90)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module, as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module, as reachable through index.php.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS3.77% — more likely to be exploited than 90% of all CVEs
WeaknessCWE-79
On CISA KEVno
Public exploityes
Published2008-09-03
Last modified2026-06-16

Affected (1)

VendorProduct
vtigervtiger crm

Public exploits

SourceTitleDate
exploit-dbvTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities2008-09-01

References

→ the Explorer  ·  watch your stack  ·  NVD