Multiple cross-site request forgery (CSRF) vulnerabilities in BugTracker.NET before 2.7.2 allow remote attackers to delete arbitrary bugs a…

published 2008-01-17 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-0346

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

Multiple cross-site request forgery (CSRF) vulnerabilities in BugTracker.NET before 2.7.2 allow remote attackers to delete arbitrary bugs and perform other administrative tasks via unspecified vectors, possibly related to delete_*.aspx pages, and massedit.aspx, subscribe.aspx, flag.aspx, and relationships.aspx.

Patch / fix

links 1

sourceforge.net/project/shownotes.php?group_id=66812&release_id=568160 patch

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

sourceforge.net /project/shownotes.php?group_id=66812&release_id=568160
patch
secunia.com /advisories/28481
third-party-advisory, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/39651
vdb-entry
sourceforge.net /tracker/index.php?func=detail&aid=1867089&group_id=66812&atid=515837

Sources

CVE List CVE-2008-0336
NVD CVE-2008-0336

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary