CVE-2008-1348

CVE-2008-1348 describes a Cross-site Scripting (XSS) vulnerability in the eWebsite eWeather module for PHP-Nuke, specifically within the index.php file. This flaw allows unauthenticated remote attackers to inject arbitrary web script or HTML by manipulating the 'chart' parameter in modules.php. With a CVSS score of 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N), it is considered a medium-severity vulnerability, requiring moderate attack complexity but potentially leading to information disclosure or session hijacking. While not listed on CISA's KEV or Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.