peter bassill · operator
$ cve CVE-2008-6325 JSON

CVE-2008-6325 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 1.5% (pctl 73)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) radio parameter to showcategory.php, (2) msg parameter to advertisers/signinform.php, (3) radio parameter to gallery.php, (4) msg parameter to lostpassword.php, (5) radio parameter to showcategory.php, (6) msg parameter to admin/adminhome.php, and (7) msg parameter to admin/index.php. NOTE: a different signinform.php file is already covered by CVE-2008-6306.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS1.49% — more likely to be exploited than 73% of all CVEs
WeaknessCWE-79
On CISA KEVno
Public exploityes
Published2009-02-27
Last modified2026-06-16

Affected (1)

VendorProduct
softbizscriptsclassifieds script

Public exploits

SourceTitleDate
exploit-dbSoftbiz Classifieds Script - 'showcategory.php?radio' Cross-Site Scripting2008-12-01
exploit-dbSoftbiz Classifieds Script - '/advertisers/signinform.php?msg' Cross-Site Scripting2008-12-01
exploit-dbSoftbiz Classifieds Script - 'gallery.php?radio' Cross-Site Scripting2008-12-01
exploit-dbSoftbiz Classifieds Script - 'lostpassword.php?msg' Cross-Site Scripting2008-12-01
exploit-dbSoftbiz Classifieds Script - '/admin/adminhome.php?msg' Cross-Site Scripting2008-12-01
exploit-dbSoftbiz Classifieds Script - '/admin/index.php?msg' Cross-Site Scripting2008-12-01

References

→ the Explorer  ·  watch your stack  ·  NVD