CVE-2008-1896

Carbon Communities <2.4 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Redirect parameter to login.asp and the (2) OrderBy parameter to member_send.asp.

Exploits (1)

exploitdb WORKING POC VERIFIED

by BugReport.IR · textwebappsasp

https://www.exploit-db.com/exploits/5456

View Code ZIP pw:eip

References (6)

[Exploit] http://bugreport.ir/index.php?/35

[Vendor Advisory] http://secunia.com/advisories/29827

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/490923/100/0/threaded

[Exploit] http://www.securityfocus.com/bid/28806

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41846

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/5456

Scores

EPSS 0.0670

EPSS Percentile 91.1%

Classification

CWE

CWE-79

Status draft

Affected Products (6)

carboncommunities/carbon_communities < 2.4

carboncommunities/carbon_communities

Timeline

Published Apr 18, 2008

Tracked Since Feb 18, 2026