CVE-2008-6700 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 1.5% (pctl 74)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php, (2) mytable parameter to viewdb2.php, (3) tablehere parameter to category-rename.php, and (4) letter parameter to module-contacts.php.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 1.51% — more likely to be exploited than 74% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-04-10 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| butterflymedia | butterfly organizer |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting | 2008-06-13 |
References
→ the Explorer · watch your stack · NVD