CVE-2008-3849

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-08-27 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably involving (1) month, (2) day, and (3) year fields.

Affected products

Civic-Cms: through 1.0

References

http://secunia.com/advisories/31609
http://secunia.com/advisories/31641
http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954
http://www.securityfocus.com/bid/30833
https://exchange.xforce.ibmcloud.com/vulnerabilities/44673
http://secunia.com/advisories/31609
http://secunia.com/advisories/31641
http://sourceforge.net/project/shownotes.php?group_id=234663&release_id=621954
http://www.securityfocus.com/bid/30833
https://exchange.xforce.ibmcloud.com/vulnerabilities/44673

Get alerted when CVE-2008-3849 or the next vulnerability affects your stack