CVE-2008-3511

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Image Gallery (Photo Gallery) allow remote attackers to inject arbitrary web script or HTML via the (1) latest parameter to (a) index.php, (b) images.php, (c) suggest_image.php, and (d) image_desc.php; and the (2) msg parameter to index.php, images.php, and suggest_image.php, and (e) index.php, (f) adminhome.php, (g) config.php, (h) changepassword.php, (i) cleanup.php, (j) browsecats.php, and (k) images.php in admin/. NOTE: the image_desc.php/msg vector is covered by CVE-2006-1660. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

• CWE-79

• http://www.securityfocus.com/bid/30546Broken Link
• http://www.securityfocus.com/bid/30546/exploitBroken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44433Third Party Advisory
• http://www.securityfocus.com/bid/30546Broken Link
• http://www.securityfocus.com/bid/30546/exploitBroken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44433Third Party Advisory

Published

Aug 7, 2008

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3505Cross-site scripting (XSS) vulnerability in PolyPager 1.0 rc…
• CVE-2008-3506SQL injection vulnerability in PolyPager 1.0 rc2 and earlier…
• CVE-2008-3507SQL injection vulnerability in index.php in LiteNews 0.1 (ak…
• CVE-2008-3508LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows …
• CVE-2008-3509LoveCMS 1.6.2 does not require administrative authentication…
• CVE-2008-3510Cross-site scripting (XSS) vulnerability in livehelp_js.php …
• CVE-2008-3512SQL injection vulnerability in the Kleinanzeigen module for …
• CVE-2008-3513SQL injection vulnerability in the Book Catalog module 1.0 f…
• CVE-2008-3514VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Up…
• CVE-2008-3515Multiple cross-site scripting (XSS) vulnerabilities in files…
• CVE-2008-3516Multiple cross-site scripting (XSS) vulnerabilities in files…
• CVE-2008-3517Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…