What’s Vulnerable › Vulnerabilities

CVE-2008-5221

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-11-25 · updated 2026-06-16
• Weakness: CWE-287

Description

The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.

Affected products

• Wportfolio: through 0.3; 0.2

References

• http://securityreason.com/securityalert/4631
• http://www.securityfocus.com/bid/32384
• http://www.vupen.com/english/advisories/2008/3219
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46772
• https://www.exploit-db.com/exploits/7170
• http://securityreason.com/securityalert/4631
• http://www.securityfocus.com/bid/32384
• http://www.vupen.com/english/advisories/2008/3219
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46772
• https://www.exploit-db.com/exploits/7170

Get alerted when CVE-2008-5221 or the next vulnerability affects your stack