$ cve CVE-2008-3668 JSON

CVE-2008-3668 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.5% (pctl 74)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or (6) tribes.php; or (7) the description field of a new scrap.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.54% — more likely to be exploited than 74% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2008-08-13
Last modified	2026-06-16

Affected (1)

Vendor	Product
marcello brandao	yogurt social network module

Public exploits

Source	Title	Date
exploit-db	Yogurt Social Network 3.2 rc1 Module for XOOPS - 'friends.php?uid' Cross-Site Scripting	2008-08-09
exploit-db	Yogurt Social Network 3.2 rc1 Module for XOOPS - 'seutubo.php?uid' Cross-Site Scripting	2008-08-09
exploit-db	Yogurt Social Network 3.2 rc1 Module for XOOPS - 'album.php?uid' Cross-Site Scripting	2008-08-09
exploit-db	Yogurt Social Network 3.2 rc1 Module for XOOPS - 'scrapbook.php?uid' Cross-Site Scripting	2008-08-09
exploit-db	Yogurt Social Network 3.2 rc1 Module for XOOPS - 'index.php?uid' Cross-Site Scripting	2008-08-09
exploit-db	Yogurt Social Network 3.2 rc1 Module for XOOPS - 'tribes.php?uid' Cross-Site Scripting	2008-08-09

References

→ the Explorer · watch your stack · NVD