CVE-2008-5814

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-02 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.

Affected products

PHP: through 5.2.7; 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2 (+102)

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
http://jvn.jp/en/jp/JVN50327700/index.html
http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000084.html
http://marc.info/?l=bugtraq&m=124277349419254&w=2
http://secunia.com/advisories/34830
http://secunia.com/advisories/34933
http://secunia.com/advisories/35003
http://secunia.com/advisories/35007
http://secunia.com/advisories/35108
http://www.debian.org/security/2009/dsa-1789
http://www.redhat.com/support/errata/RHSA-2009-0350.html
http://www.ubuntu.com/usn/USN-761-2

Get alerted when CVE-2008-5814 or the next vulnerability affects your stack