{"api_version":"1","generated_at":"2026-07-23T06:22:33+00:00","cve":"CVE-2008-5807","urls":{"html":"https://cve.report/CVE-2008-5807","api":"https://cve.report/api/cve/CVE-2008-5807.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-5807","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-5807"},"summary":{"title":"CVE-2008-5807","description":"Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-12-31 11:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://sourceforge.net/project/shownotes.php?release_id=638751","name":"http://sourceforge.net/project/shownotes.php?release_id=638751","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Page not found\n    - SourceForge.net","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://secunia.com/advisories/32599","name":"http://secunia.com/advisories/32599","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA32599 - TestLink Multiple Script Insertion Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46431","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46431","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/32173","name":"http://www.securityfocus.com/bid/32173","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"TestLink Multiple HTML Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-5807","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-5807","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"1.7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"1.7.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"1.7.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"1.7.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"1.8","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"1.8","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"5807","vulnerable":"1","versionEndIncluding":"1.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teamst","cpe5":"testlink","cpe6":"*","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T11:04:44.583Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"32599","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32599"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://sourceforge.net/project/shownotes.php?release_id=638751"},{"name":"32173","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/32173"},{"name":"testlink-testproject-plannames-xss(46431)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46431"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-11-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"32599","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32599"},{"tags":["x_refsource_CONFIRM"],"url":"http://sourceforge.net/project/shownotes.php?release_id=638751"},{"name":"32173","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/32173"},{"name":"testlink-testproject-plannames-xss(46431)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46431"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-5807","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"32599","refsource":"SECUNIA","url":"http://secunia.com/advisories/32599"},{"name":"http://sourceforge.net/project/shownotes.php?release_id=638751","refsource":"CONFIRM","url":"http://sourceforge.net/project/shownotes.php?release_id=638751"},{"name":"32173","refsource":"BID","url":"http://www.securityfocus.com/bid/32173"},{"name":"testlink-testproject-plannames-xss(46431)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46431"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-5807","datePublished":"2008-12-31T11:00:00.000Z","dateReserved":"2008-12-30T00:00:00.000Z","dateUpdated":"2024-08-07T11:04:44.583Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-12-31 11:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:*:beta3:*:*:*:*:*:*","versionEndIncluding":"1.8","matchCriteriaId":"D697B9AC-5D8A-441D-8F54-D2FA8059D6CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:1.7.1:*:*:*:*:*:*:*","matchCriteriaId":"4E88B7B2-FA29-41EF-A2FB-4B5EF3889435"},{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:1.7.2:*:*:*:*:*:*:*","matchCriteriaId":"1B667E47-CFD5-4125-844D-F79505FC95C4"},{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:1.7.3:*:*:*:*:*:*:*","matchCriteriaId":"EFFAFFD7-26B8-4ADF-B134-F71268EC9FCD"},{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:1.7.4:*:*:*:*:*:*:*","matchCriteriaId":"E136AD4F-552C-4414-A8B4-0CEC91480671"},{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:1.8:beta1:*:*:*:*:*:*","matchCriteriaId":"4434FB82-6BA6-4335-8FF0-26738318FB41"},{"vulnerable":true,"criteria":"cpe:2.3:a:teamst:testlink:1.8:beta2:*:*:*:*:*:*","matchCriteriaId":"F5FEACF5-86A6-4E8C-896E-436E2FF2948F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"5807","Ordinal":"1","Title":"CVE-2008-5807","CVE":"CVE-2008-5807","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"5807","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) Testproject Names and (2) Testplan Names in planEdit.php, and possibly (3) Testcaseprefixes in projectview.tpl.","Type":"Description","Title":"CVE-2008-5807"},{"CveYear":"2008","CveId":"5807","Ordinal":"2","NoteData":"2008-12-31","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"5807","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}