CVE-2008-2694: Cross-site scripting (XSS) vulnerability in search.php in phpInv 0.8.0 allows remote attackers to inject ar...

Security readout for executives and security teams

CVE-2008-2694 is a cross-site scripting flaw in phpInv 0.8.0. A remote attacker could cause malicious script or HTML to run through the search keyword field if a user views a crafted result. The bundle shows public exploit reference, but no KEV listing or confirmed active exploitation. Likely limited to legacy phpInv 0.8.0 installations with the search.php endpoint accessible. Organizations are exposed if users can be induced to open crafted search links or pages that reflect the keyword value without safe encoding. Prioritize if phpInv is internet-facing or used by authenticated business users. The risk is usually not infrastructure-wide, but successful XSS can enable session theft, phishing, or user-context actions. If no phpInv 0.8.0 is present, document non-exposure and close. Mitigation focus: Inventory and retire any phpInv 0.8.0 deployments where practical.; Check vendor or maintainer guidance before applying production changes.; If maintained internally, add contextual output encoding for keyword rendering..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.