CVE-2008-5090 json
Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in…
published 2008-11-14 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-5069
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.6%
- EPSS 4.6% chance of exploitation in 30 days, percentile 91%
- public exploits
- 1
- Exploit-DB
Summary
Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.
Timeline
- First public exploit (EDB-6499)
- Published
Exploit prediction
4.60% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-6499 Advanced Electron Forum 1.0.6 - Remote Code Execution webapps, 2008-09-20
- securityfocus.com http://www.securityfocus.com/bid/31268 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
exploit-db.com
/exploits/6499
exploit
-
securityfocus.com
/bid/31268
vdb-entry, exploit
-
anelectron.com
/board/index.php?tid=3282
vendor-advisory
-
secunia.com
/advisories/31978
third-party-advisory, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/45270
vdb-entry
-
securityfocus.com
/archive/1/496552/100/0/threaded
mailing-list
- gulftech.org /?node=research&article_id=00131-09202008
-
securityreason.com
/securityalert/4598
third-party-advisory
Sources
- CVE List CVE-2008-5090
- NVD CVE-2008-5090
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.