CVE-2008-3186 describes multiple Cross-Site Scripting (XSS) vulnerabilities in Chipmunk Blog (Blogger) versions. Attackers can inject arbitrary web script or HTML via the 'membername' parameter across several PHP files, including members.php, comments.php, photos.php, archive.php, and cat.php. This vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and potential for partial integrity impact. While it has a FAUCET Risk Score of 64/100, its EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. Although not listed in CISA's KEV catalog and lacking Metasploit or Nuclei modules, specific exploit code for each affected PHP file is available on ExploitDB. There is no evidence of active exploitation, and the vulnerability has received no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:chipmunk_scripts:chipmunk_blogger:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.