CVE-2008-3887

no score yetEPSS 0.9%

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the user_id parameter in a viewuser action.

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2008-09-02
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

dotproject:dotproject

References

http://packetstorm.linuxsecurity.com/0808-exploits/dotproject-sqlxss.txt
http://secunia.com/advisories/31681
http://www.securityfocus.com/bid/30924
https://exchange.xforce.ibmcloud.com/vulnerabilities/44771
https://exchange.xforce.ibmcloud.com/vulnerabilities/44772

Check your stack JSON