CVE-2008-6400: Cross-site scripting (XSS) vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrar...

Security readout for executives and security teams

CVE-2008-6400 is an old cross-site scripting issue in refbase before 0.9.5. An attacker could cause untrusted script or HTML to appear through the headerMsg parameter on show.php or search.php. Business impact depends on whether refbase is still deployed and exposed to users. Exposure is likely limited to organizations still running legacy refbase installations, especially internet-facing research bibliography sites. The bundle does not identify packaged distributions, hosted services, or exact affected version ranges beyond refbase before 0.9.5. Prioritize remediation if refbase is still public-facing or used by privileged staff. This is not supported by active exploitation evidence in the bundle, but legacy XSS can still enable account misuse, trust abuse, and session-related impact. Mitigation focus: Inventory refbase deployments and confirm whether any are older than 0.9.5.; Upgrade affected refbase installations to 0.9.5 or later where supported.; If upgrade status is unclear, check current vendor or maintainer guidance..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.