Unscored severity · published Jan 25, 2008
CVE-2008-0444
Cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via subtext parameter to…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via subtext parameter to unspecified components.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Elog · Elog
1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0444
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0444
midas.psi.ch
http://midas.psi.ch/elog/download/ChangeLog
osvdb.org
http://osvdb.org/41681
Vendor Advisory
http://secunia.com/advisories/28589
Patch
http://www.securityfocus.com/bid/27399
www.vupen.com
http://www.vupen.com/english/advisories/2008/0265
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/39828
More from Elog
8.8
CVE-2025-64349
ELOG user profile missing authorization
8.0
CVE-2025-62618
ELOG file upload stored XSS
7.1
CVE-2025-64348
ELOG configuration file authorization bypass
–
CVE-2008-7004
Buffer overflow in Electronic Logbook (ELOG) before 2.7.1 has unknown impact and attack vectors, possibly related to elog.c
–
CVE-2008-0445
The replace_inline_img function in elogd in Electronic Logbook (ELOG) before 2.7.1 allows remote attackers to cause a denial of service (infinite loop) via crafted logbook entries