{"id":"CVE-2008-2340","aliases":["EUVD-2008-2336","GHSA-jcvp-v93j-r5ch"],"status":"published","title":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute...","description":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00999,"percentile":0.63004,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2008-05-19T10:00:00Z","modified":"2026-06-16T22:53:34Z","exploits":[{"source":"exploitdb","id":"EDB-5624","title":"newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection","type":"webapps","platform":"php","date":"2008-05-15","verified":true,"url":"https://www.exploit-db.com/exploits/5624"}],"products":[{"vendor":"news_manager","product":"news_manager"}],"references":[{"url":"http://www.securityfocus.com/bid/29251","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42461","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/5624","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2340"},{"url":"https://github.com/advisories/GHSA-jcvp-v93j-r5ch"}],"sources":{"cve":[{"id":"CVE-2008-2340","description":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.","status":"published","published":"2008-05-19T10:00:00Z","modified":"2024-08-07T08:58:02.234Z","updated_at":"2026-11-02T14:34:44.675398Z"}],"euvd":[{"id":"EUVD-2008-2336","description":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.","status":"published","published":"2008-05-19T10:00:00Z","modified":"2024-08-07T08:58:02Z","updated_at":"2026-11-03T01:38:57.150072Z"}],"ghsa":[{"id":"GHSA-jcvp-v93j-r5ch","title":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute...","description":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.","status":"published","published":"2022-05-01T23:49:04Z","modified":"2023-01-31T05:06:46Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:49:05.423172Z"}],"nvd":[{"id":"CVE-2008-2340","description":"Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.","status":"published","published":"2008-05-19T13:20:00Z","modified":"2026-06-16T22:53:34.967Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:01:26.626719Z"}]}}