{"api_version":"1","generated_at":"2026-07-23T07:09:55+00:00","cve":"CVE-2008-3668","urls":{"html":"https://cve.report/CVE-2008-3668","api":"https://cve.report/api/cve/CVE-2008-3668.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-3668","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-3668"},"summary":{"title":"CVE-2008-3668","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or (6) tribes.php; or (7) the description field of a new scrap.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-08-13 18:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/30619","name":"http://www.securityfocus.com/bid/30619","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Yogurt Social Network Scrapbook HTML Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/30618","name":"http://www.securityfocus.com/bid/30618","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Yogurt Social Network 'uid' Parameter Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html","name":"http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Yogurt Social Network multiple scripts uid variable XSS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44387","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44387","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44385","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44385","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-3668","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3668","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"3668","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"marcello_brandao","cpe5":"yogurt_social_network_module","cpe6":"3.2","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:45:18.967Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"yogurtsocialnetwork-scrapbook-xss(44387)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44387"},{"name":"30618","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30618"},{"name":"yogurtsocialnetwork-uid-xss(44385)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44385"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html"},{"name":"30619","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30619"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-08-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or (6) tribes.php; or (7) the description field of a new scrap."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"yogurtsocialnetwork-scrapbook-xss(44387)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44387"},{"name":"30618","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30618"},{"name":"yogurtsocialnetwork-uid-xss(44385)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44385"},{"tags":["x_refsource_MISC"],"url":"http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html"},{"name":"30619","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30619"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-3668","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or (6) tribes.php; or (7) the description field of a new scrap."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"yogurtsocialnetwork-scrapbook-xss(44387)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44387"},{"name":"30618","refsource":"BID","url":"http://www.securityfocus.com/bid/30618"},{"name":"yogurtsocialnetwork-uid-xss(44385)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44385"},{"name":"http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html","refsource":"MISC","url":"http://lostmon.blogspot.com/2008/08/yogurt-social-network-multiple-scripts.html"},{"name":"30619","refsource":"BID","url":"http://www.securityfocus.com/bid/30619"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-3668","datePublished":"2008-08-13T18:00:00.000Z","dateReserved":"2008-08-13T00:00:00.000Z","dateUpdated":"2024-08-07T09:45:18.967Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-08-13 18:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:marcello_brandao:yogurt_social_network_module:3.2:rc1:*:*:*:*:*:*","matchCriteriaId":"010CFAED-5F89-453A-ABE3-6E9B2B878490"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"3668","Ordinal":"1","Title":"CVE-2008-3668","CVE":"CVE-2008-3668","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"3668","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or (6) tribes.php; or (7) the description field of a new scrap.","Type":"Description","Title":"CVE-2008-3668"},{"CveYear":"2008","CveId":"3668","Ordinal":"2","NoteData":"2008-08-13","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"3668","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}