CVE-2008-1971
phphq phshoutbox final: no CVSS score yet. EPSS 2.2% chance of exploitation in the next 30 days.
phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-11-01)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- phphq:phshoutbox_final