CVE-2008-4456
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0...
2.6 LowPublic exploitFix available
CVE-2008-4456 is a low vulnerability (CVSS 2.6) in Mysql, published October 6, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.05%, the 94th percentile. Fixed in mysql-dfsg-5.0 5.0.32-7etch10.
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
Exploit likelihood
7.05%Down 32.8 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
- Record
CVE-2008-4456- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
- Record
CVE-2008-4456- Updated
- 2026-11-02
EUVDEUVD-2008-4437 No score
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
- Record
EUVD-2008-4437- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wwgr-xr73-wm3j No score
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0...
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
- Record
GHSA-wwgr-xr73-wm3j- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-dfsg-5.0Debian:4.0 |
before 5.0.32-7etch10, plus listed versions 5.0.32-7etch15.0.32-7etch35.0.32-7etch3~bpo31+15.0.32-7etch45.0.32-7etch55.0.32-7etch5~bpo31+15.0.32-7etch65.0.32-7etch8 |
5.0.32-7etch10 |
mysql-dfsg-5.0Debian:5.0 |
before 5.0.51a-24+lenny1, plus listed versions 5.0.51a-235.0.51a-245.0.51a-24+lenny1~bpo40+15.0.51a-24~bpo40+1 |
5.0.51a-24+lenny1 |
mysqlRed Hat:enterprise_linux:5::client_workstation |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-benchRed Hat:enterprise_linux:5::client_workstation |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-develRed Hat:enterprise_linux:5::client_workstation |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-serverRed Hat:enterprise_linux:5::client_workstation |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-testRed Hat:enterprise_linux:5::client_workstation |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysqlRed Hat:enterprise_linux:5::client |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-debuginfoRed Hat:enterprise_linux:5::client |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
Show 79 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysqlRed Hat:enterprise_linux:5::server |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-benchRed Hat:enterprise_linux:5::server |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-debuginfoRed Hat:enterprise_linux:5::server |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-develRed Hat:enterprise_linux:5::server |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-serverRed Hat:enterprise_linux:5::server |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-testRed Hat:enterprise_linux:5::server |
before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
httpdRed Hat:rhel_application_stack:2 |
before 0:2.2.13-2.el5s2 | 0:2.2.13-2.el5s2 |
httpd-debuginfoRed Hat:rhel_application_stack:2 |
before 0:2.2.13-2.el5s2 | 0:2.2.13-2.el5s2 |
httpd-develRed Hat:rhel_application_stack:2 |
before 0:2.2.13-2.el5s2 | 0:2.2.13-2.el5s2 |
httpd-manualRed Hat:rhel_application_stack:2 |
before 0:2.2.13-2.el5s2 | 0:2.2.13-2.el5s2 |
mod_sslRed Hat:rhel_application_stack:2 |
before 1:2.2.13-2.el5s2 | 1:2.2.13-2.el5s2 |
mysqlRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-benchRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-clusterRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-debuginfoRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-develRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-libsRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-serverRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
mysql-testRed Hat:rhel_application_stack:2 |
before 0:5.0.84-2.el5s2 | 0:5.0.84-2.el5s2 |
perl-DBD-MySQLRed Hat:rhel_application_stack:2 |
before 0:4.012-1.el5s2 | 0:4.012-1.el5s2 |
perl-DBD-MySQL-debuginfoRed Hat:rhel_application_stack:2 |
before 0:4.012-1.el5s2 | 0:4.012-1.el5s2 |
perl-DBIRed Hat:rhel_application_stack:2 |
before 0:1.609-1.el5s2 | 0:1.609-1.el5s2 |
perl-DBI-debuginfoRed Hat:rhel_application_stack:2 |
before 0:1.609-1.el5s2 | 0:1.609-1.el5s2 |
phpRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-bcmathRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-cliRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-commonRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-dbaRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-debuginfoRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-develRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-gdRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-imapRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-ldapRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-mbstringRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-mysqlRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-ncursesRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-odbcRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-pdoRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-pearRed Hat:rhel_application_stack:2 |
before 1:1.8.1-2.el5s2 | 1:1.8.1-2.el5s2 |
php-pgsqlRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-snmpRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-soapRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-xmlRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
php-xmlrpcRed Hat:rhel_application_stack:2 |
before 0:5.2.10-1.el5s2 | 0:5.2.10-1.el5s2 |
postgresqlRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-contribRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-develRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-docsRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-jdbcRed Hat:rhel_application_stack:2 |
before 0:8.2.510-1jpp.el5s2 | 0:8.2.510-1jpp.el5s2 |
postgresql-jdbc-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.2.510-1jpp.el5s2 | 0:8.2.510-1jpp.el5s2 |
postgresql-libsRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-plperlRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-plpythonRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-pltclRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-pythonRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-serverRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-tclRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
postgresql-testRed Hat:rhel_application_stack:2 |
before 0:8.2.14-1.el5s2 | 0:8.2.14-1.el5s2 |
mysqlRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysqlRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysqlRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysqlRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MySQL 5 - Command Line Client HTML Special Characters HTML Injection | 2008-09-30 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
securityfocus.com/archive/1/497885/100/0/threaded
mandriva.com/security/advisories?name=MDVSA-2009:094
ubuntu.com/usn/USN-1397-1
exchange.xforce.ibmcloud.com/vulnerabilities/45590
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456
Show 86 moreShow less
secunia.com/advisories/38517
debian.org/security/2009/dsa-1783
bugs.mysql.com/bug.php?id=27884
ubuntu.com/usn/usn-897-1
redhat.com/support/errata/RHSA-2009-1289.html
lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
support.apple.com/kb/HT4077
henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability
seclists.org/bugtraq/2008/Oct/0026.html
securityreason.com/securityalert/4357
nvd.nist.gov/vuln/detail/CVE-2008-4456
github.com/advisories/GHSA-wwgr-xr73-wm3j
access.redhat.com/errata/RHSA-2009:1289
bugzilla.redhat.com/show_bug.cgi?id=462534
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1289.json
cve.org/CVERecord?id=CVE-2008-2079
dev.mysql.com/doc/refman/4.1/en/symbolic-links-to-tables.html