CVE-2008-3664 - CVE House
Back to Database
Status published Medium CVE-2008-3664

Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via (1) the real name field, related to the user list; (2) the target parameter to login.php, (3) the title parameter to activities/some.php, (4) the company_name parameter to companies/some.php, (5) the last_name parameter to contacts/some.php, (6) the campaign_title parameter to campaigns/some.php, (7) the opportunity_title parameter to opportunities/some.php, (8) the case_title parameter to cases/some.php, (9) the file_id parameter to files/some.php, or (10) the starting parameter to reports/custom/mileage.php, a related issue to CVE-2008-1129.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-3664

Credits & Attribution

No credits recorded in the NVD database.

References

More from xrms

View All →
CVE-2008-3948
SQL injection vulnerability in admin/users/self-2.php in XRMS allows remote attackers...
High 7.5
CVE-2008-3400
XRMS CRM 1.99.2 allows remote attackers to obtain configuration information...
Medium 4.3
CVE-2008-3399
PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM...
Medium 6.8
CVE-2008-3398
Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow...
Low 2.6

Affected Vendor

Affected Software

xrms crm
Vulnerable Versions:
Unknown

Timeline

Official Publish: September 5th, 2008
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.