CVE-2008-1972
Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when the Allow Registration? configuration option is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) firstname, (3) lastname, and (4) e-mail address fields. NOTE: some of these details are obtained from third party information.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oicgroup:exponent_cms
References
- http://secunia.com/advisories/29875
- http://sourceforge.net/project/shownotes.php?release_id=592961&group_id=118524
- http://www.exponentcms.org/index.php?action=view&id=64&module=newsmodule&src=%40random44fe03276195
- http://www.securityfocus.com/bid/28834
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41878