CVE-2008-7213

Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter.

• CWE-79

• http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
• http://forum.mambo-foundation.org/showthread.php?t=10158
• http://osvdb.org/42530
• http://secunia.com/advisories/28670Vendor Advisory
• http://www.bugreport.ir/index_33.htmExploit
• http://www.securityfocus.com/archive/1/487128/100/200/threaded
• http://www.securityfocus.com/bid/27470Exploit
• http://www.vupen.com/english/advisories/2008/0325Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39984
• http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
• http://forum.mambo-foundation.org/showthread.php?t=10158
• http://osvdb.org/42530
• http://secunia.com/advisories/28670Vendor Advisory
• http://www.bugreport.ir/index_33.htmExploit
• http://www.securityfocus.com/archive/1/487128/100/200/threaded
• http://www.securityfocus.com/bid/27470Exploit
• http://www.vupen.com/english/advisories/2008/0325Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39984

Published

Sep 11, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-7207RivetTracker before 1.0 stores passwords in cleartext in con…
• CVE-2008-7208Multiple SQL injection vulnerabilities in OneCMS 2.4, and po…
• CVE-2008-7209Unrestricted file upload vulnerability in the add2 action in…
• CVE-2008-7210directory.php in AJchat 0.10 allows remote attackers to bypa…
• CVE-2008-7211CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as us…
• CVE-2008-7212MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, all…
• CVE-2008-7214Cross-site request forgery (CSRF) vulnerability in administr…
• CVE-2008-7215The Image Manager in MOStlyCE before 2.4, as used in Mambo 4…
• CVE-2008-7216Peter's Math Anti-Spam Spinoff plugin for WordPress generate…
• CVE-2008-7217Microsoft Office 2008 for Mac, when running on Macintosh sys…
• CVE-2008-7218Unspecified vulnerability in the Horde API in Horde 3.1 befo…
• CVE-2008-7219Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; …