{"api_version":"1","generated_at":"2026-07-23T06:14:31+00:00","cve":"CVE-2008-1850","urls":{"html":"https://cve.report/CVE-2008-1850","api":"https://cve.report/api/cve/CVE-2008-1850.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-1850","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-1850"},"summary":{"title":"CVE-2008-1850","description":"Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-04-16 17:05:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/29779","name":"http://secunia.com/advisories/29779","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"OSI Affiliate \"login.php\" Cross-Site Scripting Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/28793","name":"http://www.securityfocus.com/bid/28793","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Omnistar OSI Affiliate 'login.php' Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.osvdb.org/44376","name":"http://www.osvdb.org/44376","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41825","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41825","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/","name":"http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Vulnerabilidad XSS en el sistema de gestión de afiliados Ossafiliate | El blog de José Luís Zayas","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/28785","name":"http://www.securityfocus.com/bid/28785","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WORK system e-commerce 'main.php' Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41811","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41811","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1850","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1850","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"1850","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"osiaffiliate","cpe5":"osiaffiliate","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T08:40:58.607Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"28793","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/28793"},{"name":"osi-affiliate-login-xss(41825)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41825"},{"name":"29779","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29779"},{"name":"44376","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/44376"},{"name":"28785","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/28785"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/"},{"name":"work-systemecommerce-main-xss(41811)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41811"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-04-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"28793","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/28793"},{"name":"osi-affiliate-login-xss(41825)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41825"},{"name":"29779","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29779"},{"name":"44376","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/44376"},{"name":"28785","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/28785"},{"tags":["x_refsource_MISC"],"url":"http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/"},{"name":"work-systemecommerce-main-xss(41811)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41811"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-1850","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"28793","refsource":"BID","url":"http://www.securityfocus.com/bid/28793"},{"name":"osi-affiliate-login-xss(41825)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41825"},{"name":"29779","refsource":"SECUNIA","url":"http://secunia.com/advisories/29779"},{"name":"44376","refsource":"OSVDB","url":"http://www.osvdb.org/44376"},{"name":"28785","refsource":"BID","url":"http://www.securityfocus.com/bid/28785"},{"name":"http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/","refsource":"MISC","url":"http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/"},{"name":"work-systemecommerce-main-xss(41811)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41811"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-1850","datePublished":"2008-04-16T17:00:00.000Z","dateReserved":"2008-04-16T00:00:00.000Z","dateUpdated":"2024-08-07T08:40:58.607Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-04-16 17:05:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:osiaffiliate:osiaffiliate:*:*:*:*:*:*:*:*","matchCriteriaId":"5E461E76-01C2-4036-BEF5-7539ED7E3465"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"1850","Ordinal":"1","Title":"CVE-2008-1850","CVE":"CVE-2008-1850","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"1850","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters.","Type":"Description","Title":"CVE-2008-1850"},{"CveYear":"2008","CveId":"1850","Ordinal":"2","NoteData":"2008-04-16","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"1850","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}