CVE-2008-2553

Cross-site scripting (XSS) vulnerability in Slashdot Like Automated Storytelling Homepage (Slash)...

4.3 Medium

Cross-site scripting (XSS) vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to inject arbitrary web script or HTML via the userfield parameter.

Exploit likelihood

1.56%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2008-2553
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-2553
Updated: 2026-11-02

EUVDEUVD-2008-2548 No score

Record: EUVD-2008-2548
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f5w5-26m9-xm9p No score

Cross-site scripting (XSS) vulnerability in Slashdot Like Automated Storytelling Homepage (Slash)...

Record: GHSA-f5w5-26m9-xm9p
Weakness: CWE-79
Updated: 2026-11-02

Affected products

slashcode.com slash

Affected packages

Affected packages
Package	Affected	Fixed
`slash` Debian:4.0 From an advisory covering 2 CVEs	before 2.2.6-8etch1, plus listed versions 2.2.6-8	2.2.6-8etch1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2553 is a medium vulnerability (CVSS 4.3) in Slashcode.com Slash, published June 5, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. No source names a fixed version.

References

Show 5 moreShow less