{
    "id": "CVE-2008-3260",
    "published": "2008-07-22 17:41:00",
    "last_modified": "2026-06-16 22:55:29",
    "cvss_score": "4.3",
    "cvss_severity": "MEDIUM",
    "cvss_version": "2.0",
    "cvss_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "cwe": "CWE-79",
    "description": "Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.",
    "epss_score": "0.04627",
    "epss_percentile": "0.91432",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 1,
    "updated_at": "2026-10-03 18:17:07",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "A public exploit exists."
    },
    "products": [
        {
            "vendor": "claroline",
            "product": "claroline"
        }
    ],
    "kev_detail": null,
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "32059",
            "title": "Claroline 1.8.9 - 'announcements/announcements.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32059"
        },
        {
            "source": "exploit-db",
            "ref_id": "32060",
            "title": "Claroline 1.8.9 - 'calendar/agenda.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32060"
        },
        {
            "source": "exploit-db",
            "ref_id": "32061",
            "title": "Claroline 1.8.9 - 'course/index.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32061"
        },
        {
            "source": "exploit-db",
            "ref_id": "32062",
            "title": "Claroline 1.8.9 - 'course_description/index.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32062"
        },
        {
            "source": "exploit-db",
            "ref_id": "32063",
            "title": "Claroline 1.8.9 - 'document/document.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32063"
        },
        {
            "source": "exploit-db",
            "ref_id": "32064",
            "title": "Claroline 1.8.9 - 'exercise/exercise.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32064"
        },
        {
            "source": "exploit-db",
            "ref_id": "32065",
            "title": "Claroline 1.8.9 - 'group/group_space.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32065"
        },
        {
            "source": "exploit-db",
            "ref_id": "32066",
            "title": "Claroline 1.8.9 - '/phpBB/newtopic.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32066"
        },
        {
            "source": "exploit-db",
            "ref_id": "32067",
            "title": "Claroline 1.8.9 - 'phpBB/reply.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32067"
        },
        {
            "source": "exploit-db",
            "ref_id": "32068",
            "title": "Claroline 1.8.9 - 'phpBB/viewtopic.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32068"
        },
        {
            "source": "exploit-db",
            "ref_id": "32069",
            "title": "Claroline 1.8.9 - 'wiki/wiki.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32069"
        },
        {
            "source": "exploit-db",
            "ref_id": "32070",
            "title": "Claroline 1.8.9 - 'work/work.php' Cross-Site Scripting",
            "date": "2008-07-15",
            "url": "https://www.exploit-db.com/exploits/32070"
        }
    ],
    "refs_list": [
        "http://claroline.svn.sourceforge.net/viewrc/claroline/branches/1.8/claroline/?sortby=date#dirlist",
        "http://secunia.com/advisories/31116",
        "http://securityreason.com/securityalert/4020",
        "http://sourceforge.net/project/shownotes.php?release_id=613634",
        "http://wiki.claroline.net/index.php/Changelog_1.8.x#Modification_between_claroline_1.8.9_and_1.8.10",
        "http://www.securityfocus.com/archive/1/494539/100/0/threaded",
        "http://www.securityfocus.com/bid/30269",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/43854",
        "http://claroline.svn.sourceforge.net/viewrc/claroline/branches/1.8/claroline/?sortby=date#dirlist",
        "http://secunia.com/advisories/31116",
        "http://securityreason.com/securityalert/4020",
        "http://sourceforge.net/project/shownotes.php?release_id=613634",
        "http://wiki.claroline.net/index.php/Changelog_1.8.x#Modification_between_claroline_1.8.9_and_1.8.10",
        "http://www.securityfocus.com/archive/1/494539/100/0/threaded",
        "http://www.securityfocus.com/bid/30269",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/43854"
    ]
}