CVE-2008-4456: mysql
Vulnerability summary
CVE-2008-4456 is a low (CVSS 2.6) vulnerability in mysql. EPSS estimates a 7.05% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities. 2 public exploits are recorded.
Weaponized exploit (exploit-database, 30-09-2008)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4Timeline
- 06-10-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
7.05%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.05% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (bugs.mysql.com)
Maturity: unknown
MySQL 5 - Command Line Client HTML Special Characters HTML Injection
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Mysql1 product
- mysql5.0.4 | 5.0.30 | 5.0.36 | 5.0.44
Oracle1 product
- mysqlEOL5.0.26 | 5.0.27 | 5.0.30:sp1 | 5.0.32 | 5.0.33 | 5.0.37 | 5.0.38 | 5.0.41 | 5.0.42 | 5.0.45 | 5.0.67
2 vendors · 2 products
References
23 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456VDB EntrySignatureX Refsource OVAL
Show all 23 references
- support.apple.com/kb/HT4077X Refsource CONFIRM