CVE-2008-4343

The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.

• CWE-20

• http://secunia.com/advisories/31951Vendor Advisory
• http://www.securityfocus.com/bid/31332
• http://www.shinnai.net/xplits/TXT_rNowA1916DKFNUF48NySExploit, URL Repurposed
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45333
• https://www.exploit-db.com/exploits/6537
• http://secunia.com/advisories/31951Vendor Advisory
• http://www.securityfocus.com/bid/31332
• http://www.shinnai.net/xplits/TXT_rNowA1916DKFNUF48NySExploit, URL Repurposed
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45333
• https://www.exploit-db.com/exploits/6537

Published

Sep 30, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4337Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 …
• CVE-2008-4338SQL injection vulnerability in the brilliant_gallery_checkli…
• CVE-2008-4339Unspecified vulnerability in the Java Administration GUI (jn…
• CVE-2008-4340Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attack…
• CVE-2008-4341add.php in MyBlog 0.9.8 and earlier allows remote attackers …
• CVE-2008-4342NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.…
• CVE-2008-4344SQL injection vulnerability in cat.php in 6rbScript allows r…
• CVE-2008-4345SQL injection vulnerability in download.php in WebPortal CMS…
• CVE-2008-4346Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.…
• CVE-2008-4347SQL injection vulnerability in newskom.php in Powie pNews 2.…
• CVE-2008-4348SQL injection vulnerability in photo.php in PHPortfolio, pos…
• CVE-2008-4349Multiple cross-site scripting (XSS) vulnerabilities in news.…