CVE-2008-1502

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products…

published March 25, 2008

CVSS

—

EPSS

11%

Percentile

95.7

In the wild

Unconfirmed

What it is

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.10503 · 95.7th percentile
Published: 2008-03-25T19:00Z

EPSS history

Timeline

25 MAR 19:00Z
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products…
cvelistv5