CVE-2008-2490: Cross-site scripting (XSS) vulnerability in the KJ Image Lightbox 2 (aka kj_imagelightbox2) extension 1.4.2...

Security readout for executives and security teams

This CVE describes a cross-site scripting issue in the KJ Image Lightbox 2 TYPO3 extension, version 1.4.2 and earlier. A remote attacker could inject script or HTML through unspecified user input, potentially affecting site visitors or administrators who view affected pages. Exposure is likely limited to legacy TYPO3 sites that installed KJ Image Lightbox 2 version 1.4.2 or earlier. The bundle does not identify broader TYPO3 core exposure or other products. Treat this as a legacy web application cleanup item with moderate business urgency. It is not supported by KEV evidence, but XSS in CMS extensions can create account, content, and visitor trust risk. Mitigation focus: Inventory TYPO3 sites for the kj_imagelightbox2 extension.; Confirm whether installed versions are 1.4.2 or earlier.; Check TYPO3 and extension maintainer guidance for a fixed release or workaround..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.