Unscored severity · published Aug 10, 2009
CVE-2008-6927
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary…
–
CVSS
4.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cpanel · Cpanel
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6927
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6927
Vendor Advisory
http://secunia.com/advisories/32423
www.netenberg.com
http://www.netenberg.com/forum/index.php?topic=6832
Exploit
http://www.osvdb.org/49518
www.securityfocus.com
http://www.securityfocus.com/archive/1/497964/100/0/threaded
Exploit
http://www.securityfocus.com/archive/1/498519
www.securityfocus.com
http://www.securityfocus.com/archive/1/498526
More from Cpanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.8
CVE-2020-26108
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488)
9.8
CVE-2020-26105
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554)
9.8
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549)
9.8
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497)