Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via (1) the real…

Published 18 y ago 2008-09-05 · modified 4 mo ago 2026-06-16 · JSON

CVSS

4.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

1.5%

percentile 74%

Public exploits

Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via (1) the real name field, related to the user list; (2) the target parameter to login.php, (3) the title parameter to activities/some.php, (4) the company_name parameter to companies/some.php, (5) the last_name parameter to contacts/some.php, (6) the campaign_title parameter to campaigns/some.php, (7) the opportunity_title parameter to opportunities/some.php, (8) the case_title parameter to cases/some.php, (9) the file_id parameter to files/some.php, or (10) the starting parameter to reports/custom/mileage.php, a related issue to CVE-2008-1129.

Exploit prediction (EPSS)

1.49% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

Exploits and detections

EDB-32327 XRms 1.99.2 - 'starting' Cross-Site Scripting · webapps · 2008-09-04
EDB-32326 XRms 1.99.2 - 'file_id' Cross-Site Scripting · webapps · 2008-09-04
EDB-32325 XRms 1.99.2 - 'case_title' Cross-Site Scripting · webapps · 2008-09-04
EDB-32324 XRms 1.99.2 - 'opportunity_title' Cross-Site Scripting · webapps · 2008-09-04
EDB-32323 XRms 1.99.2 - 'campaign_title' Cross-Site Scripting · webapps · 2008-09-04
EDB-32322 XRms 1.99.2 - 'last_name' Cross-Site Scripting · webapps · 2008-09-04
EDB-32321 XRms 1.99.2 - 'company_name' Cross-Site Scripting · webapps · 2008-09-04
EDB-32320 XRms 1.99.2 - 'title' Cross-Site Scripting · webapps · 2008-09-04
EDB-32318 XRms 1.99.2 - 'login.php?target' Cross-Site Scripting · webapps · 2008-09-04

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

securityfocus.com /archive/1/495981/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
securityreason.com /securityalert/4229 · third-party-advisory, x_refsource_SREASON, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/45142 · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /bid/31008 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2008-3664
NVD: CVE-2008-3664

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.