CVE-2008-3292
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain...
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.
Exploit likelihood
What each source reports
NVD Score used
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.
- Record
CVE-2008-3292- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.
- Record
CVE-2008-3292- Updated
- 2026-11-02
EUVDEUVD-2008-3280 No score
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.
- Record
EUVD-2008-3280- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j5j3-h5ww-vvph No score
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain...
constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie, as demonstrated via addpage.php.
- Record
GHSA-j5j3-h5ww-vvph- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | EZWebAlbum - Insecure Cookie Handling | 2008-07-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3292 is a medium vulnerability (CVSS 6.4) in Ezwebalbum, published July 24, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.32%, the 94th percentile. No source names a fixed version.