CVE-2008-1414

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-03-20 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to (1) index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or (2) clientinfo.php, (3) invoices.php, (4) smartlinks.php, and (5) todo.php, as demonstrated using a META tag.

Affected products

Riceball Multiple Time Sheets: all versions

References

http://secunia.com/advisories/29416
http://securityreason.com/securityalert/3756
http://www.securityfocus.com/archive/1/489689/100/0/threaded
http://www.securityfocus.com/bid/28263
http://www.vupen.com/english/advisories/2008/0911/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41227
https://www.exploit-db.com/exploits/5262
http://secunia.com/advisories/29416
http://securityreason.com/securityalert/3756
http://www.securityfocus.com/archive/1/489689/100/0/threaded
http://www.securityfocus.com/bid/28263
http://www.vupen.com/english/advisories/2008/0911/references

Get alerted when CVE-2008-1414 or the next vulnerability affects your stack