CVE-2008-2011: National Rail Enquiries Live Departure Boards

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the National Rail Enquiries Live Departure Boards gadget before 1.1 allows remote National Rail Enquiries servers or man-in-the-middle attackers to inject arbitrary web script or HTML, and execute arbitrary code, via a response body, as demonstrated by a SCRIPT element that references a vbscript: URI.

Affected products

• National Rail Enquiries National Rail Enquiries Live Departure Boards: up to and including 1.1

Published 2008-04-30. Last modified 2026-06-16.