CVE-2008-5221: The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication...

Security readout for executives and security teams

CVE-2008-5221 lets an unauthenticated remote attacker change the administrator password in wPortfolio 0.3 and earlier. For an exposed instance, this can mean rapid admin takeover. The public record does not provide CVSS, vendor fix details, or evidence of active exploitation. Exposure is limited to organizations still running wPortfolio 0.3 or earlier, especially if the admin path is reachable from the internet. The source bundle does not provide CPEs, package identifiers, or current prevalence data. Prioritize remediation if wPortfolio is present and exposed. The business risk is administrator account takeover, but urgency depends on whether this old software exists in your environment. No active exploitation evidence is provided. Mitigation focus: Identify any deployed wPortfolio 0.3 or earlier instances.; Restrict access to admin/userinfo.php and the admin area immediately.; Check vendor or project guidance for a fixed release or supported replacement..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.