CVE-2008-0851

Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to...

4.3 MediumPublic exploit

Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to inscription.php, (2) courseCode parameter to main/calendar/myagenda.php, (3) category parameter to main/admin/course_category.php, (4) message parameter to main/admin/session_list.php in a show_message action, and (5) an avatar image to main/auth/profile.php.

Exploit likelihood

3.96%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2008-0851
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-0851
Updated: 2026-11-02

EUVDEUVD-2008-0858 No score

Record: EUVD-2008-0858
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8mff-wqx9-7fr3 No score

Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to...

Record: GHSA-8mff-wqx9-7fr3
Weakness: CWE-79
Updated: 2026-11-02

Affected products

dokeos e-learning system

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Dokeos 1.8.4 - '/main/calendar/myagenda.php?courseCode' Cross-Site Scripting	2008-02-15
Exploit-DB	Dokeos 1.8.4 - '/main/admin/course_category.php?category' Cross-Site Scripting	2008-02-15
Exploit-DB	Dokeos 1.8.4 - '/main/admin/session_list.php?cmessage' Cross-Site Scripting	2008-02-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-0851 is a medium vulnerability (CVSS 4.3) in Dokeos E-learning System, published February 21, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.96%, the 90th percentile. No source names a fixed version.