CVE-2008-6644

Dotnetnuke < 4.8.3 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Exploits (1)

exploitdb WORKING POC VERIFIED

by AmnPardaz Security Research Team · textwebappsasp

https://www.exploit-db.com/exploits/31865

View Code ZIP pw:eip

References (5)

[Various Sources] http://www.dotnetnuke.com/News/SecurityPolicy/SecurityBulletinno19/tabid/1166/Default.aspx

[Exploit] http://www.securityfocus.com/bid/29437

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/42752

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/492793/100/0/threaded

[Third Party Advisory] http://secunia.com/advisories/30617

Scores

EPSS 0.0033

EPSS Percentile 55.8%

Classification

CWE

CWE-79

Status published

Affected Products (20)

dotnetnuke/dotnetnuke < 4.8.3

dotnetnuke/dotnetnuke

... and 5 more

Timeline

Published Apr 07, 2009

Tracked Since Feb 18, 2026