CVE-2008-1917: Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrar...

Security readout for executives and security teams

CVE-2008-1917 describes cross-site scripting in AMFPHP 1.2 browser utility pages. If those files are exposed, an attacker may cause injected script or HTML to run in a user's browser. The source record warns that the provenance is unknown and details come only from third-party information. Likely exposure is limited to systems still running AMFPHP 1.2 with the browser directory or named PHP files reachable by users or the internet. The provided affected-product metadata is incomplete, so asset discovery is required. Treat this as a legacy exposure cleanup item unless AMFPHP 1.2 is internet-facing or used in sensitive administrative workflows. The business risk rises when authenticated staff can be targeted through exposed XSS pages. Mitigation focus: Identify any AMFPHP 1.2 deployments and exposed browser utility pages.; Check AMFPHP or maintainer guidance for supported fixes or replacement paths.; Restrict public access to the browser directory if it is not required..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.