CVE-2008-3712: mambo Cross-site Scripting

EPSS trend

Probability

1.88%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

0.00 pp

From 1.88% on 20-09-2026

20-09-202620-10-2026

EPSS score

1.88%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
Mambo Open Source 4.6.2 - '/administrator/popups/index3pop.php?mosConfig_sitename' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
Mambo Open Source 4.6.2 - '/mambots/editors/mostlyce/' PHP/connector.php?Query String Cross-Site Scripting
Maturity: poc

References

6 links

secunia.com/advisories/31528Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/44502VDB EntryX Refsource XF
exchange.xforce.ibmcloud.com/vulnerabilities/44503VDB EntryX Refsource XF
www.securityfocus.com/archive/1/495507/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/30708VDB EntryX Refsource BIDExploit
securityreason.com/securityalert/4164Third Party AdvisoryX Refsource SREASON

Related vulnerabilities

CVE-2007-2557mambomambo0.85%19y ago09-05-2007 18:00MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.CVE-2007-0374joomlajoomla\!+11.28%19y ago19-01-2007 23:00SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.CVE-2007-0789mambomambo1.05%19y ago06-02-2007 19:00SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter.CVE-2007-6455mambomambo1.50%18y ago20-12-2007 00:00Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Itemid parameter in a com_frontpage option and the (2) option parameter.CVE-2005-2002mambomambo1.32%21y ago20-06-2005 04:00SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter.CVE-2005-0512mambomambo1.28%21y ago23-02-2005 05:00PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693.

All vulnerabilities inmambo

CVE-2008-3712: mambo Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References