CVE-2008-0793

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-02-15 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in search.asp in Tendenci CMS allow remote attackers to inject arbitrary web script or HTML via the (1) category, (2) searchtext, (3) jobcategoryid, (4) contactcompany, and unspecified other parameters. NOTE: some of these details are obtained from third party information. NOTE: it is not clear whether this affects Tendenci Enterprise Edition in addition to the product's deployment on Tendenci's own server farm. If only the latter was affected, then this issue should not be included in CVE.

Affected products

tendenci Cms: all versions

References

http://blog.tendenci.com/2008/02/cross-site-scri.html
http://holisticinfosec.blogspot.com/2008/02/fastest-fix-in-west-vendors-excellent.html
http://secunia.com/advisories/28882
http://www.securityfocus.com/bid/27782
https://exchange.xforce.ibmcloud.com/vulnerabilities/40477
http://blog.tendenci.com/2008/02/cross-site-scri.html
http://holisticinfosec.blogspot.com/2008/02/fastest-fix-in-west-vendors-excellent.html
http://secunia.com/advisories/28882
http://www.securityfocus.com/bid/27782
https://exchange.xforce.ibmcloud.com/vulnerabilities/40477

Get alerted when CVE-2008-0793 or the next vulnerability affects your stack