CVE-2008-3260
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote...
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.
- Record
CVE-2008-3260- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.
- Record
CVE-2008-3260- Updated
- 2026-11-02
EUVDEUVD-2008-3248 No score
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.
- Record
EUVD-2008-3248- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhgj-x6rx-cfm3 No score
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote...
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.
- Record
GHSA-hhgj-x6rx-cfm3- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Claroline 1.8.9 - 'announcements/announcements.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'calendar/agenda.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'course/index.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'course_description/index.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'document/document.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'exercise/exercise.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'group/group_space.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - '/phpBB/newtopic.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'phpBB/reply.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'phpBB/viewtopic.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'wiki/wiki.php' Cross-Site Scripting | 2008-07-15 |
| Exploit-DB | Claroline 1.8.9 - 'work/work.php' Cross-Site Scripting | 2008-07-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3260 is a medium vulnerability (CVSS 4.3) in Claroline, published July 22, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.63%, the 91st percentile. No source names a fixed version.