CVE-2008-7089

Pligg CMS < 9.9.0 - Cross-Site Scripting via Search Keyword Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-7089. PoCs published by GulfTech Security.

AI-analyzed exploit summary This is a detailed advisory describing multiple vulnerabilities in Pligg CMS, including SQL injection, XSS, and arbitrary file access. It provides technical explanations and exploitation examples but does not include executable exploit code.

Description

Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a search action to user.php and other unspecified vectors.

Exploits (1)

exploitdb WRITEUP VERIFIED
by GulfTech Security · textwebappsphp
https://www.exploit-db.com/exploits/6173

This is a detailed advisory describing multiple vulnerabilities in Pligg CMS, including SQL injection, XSS, and arbitrary file access. It provides technical explanations and exploitation examples but does not include executable exploit code.

Classification
Writeup 100%
Attack Type
Sqli | Xss | Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Pligg CMS <= 9.9
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44187
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/494987/100/0/threaded
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30458
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/50186
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6173

Scores

EPSS 0.0171
EPSS Percentile 74.3%

Details

CWE
CWE-79
Status published
Products (3)
pligg/pligg_cms 9.5
pligg/pligg_cms 9.9.0 beta
pligg/pligg_cms < 9.9.0
Published Aug 26, 2009
Tracked Since Feb 18, 2026