CVE-2008-4149
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1...
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.
- Record
CVE-2008-4149- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.
- Record
CVE-2008-4149- Updated
- 2026-11-02
EUVDEUVD-2008-4132 No score
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.
- Record
EUVD-2008-4132- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qrfg-pqhp-45pv No score
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1...
Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.
- Record
GHSA-qrfg-pqhp-45pv- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-4149 is a medium vulnerability (CVSS 4.3) in Drupal Link To Us, published September 19, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. No source names a fixed version.
References
drupal.org/node/309861
vupen.com/english/advisories/2008/2618
securityfocus.com/bid/31224
lists.grok.org.uk/pipermail/full-disclosure/2008-September/064527.html
secunia.com/advisories/31914
exchange.xforce.ibmcloud.com/vulnerabilities/45221
nvd.nist.gov/vuln/detail/CVE-2008-4149
github.com/advisories/GHSA-qrfg-pqhp-45pv