$ cve CVE-2008-3679 JSON

CVE-2008-3679 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.5% (pctl 73)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in index.php in IDevSpot PhpLinkExchange 1.01 allow remote attackers to inject arbitrary web script or HTML via the catid parameter in a (1) user_add, (2) recip, (3) tellafriend, or (4) contact action, or (5) in a request without an action; or (6) the id parameter in a tellafriend action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.47% — more likely to be exploited than 73% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2008-08-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
idevspot	phplinkexchange

Public exploits

Source	Title	Date
exploit-db	PhpLinkExchange 1.02 - Cross-Site Scripting / Upload	2009-12-16
exploit-db	IDevSpot PHPLinkExchange 1.01/1.02 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities	2008-08-12

References

→ the Explorer · watch your stack · NVD