CVE-2008-2018: Phpizabi

Medium severity, CVSS 4.0. EPSS: 2.2% chance of exploitation in the next 30 days.

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "{user.password}" comment in the profile of the admin user.

Affected products

• Phpizabi Phpizabi: version 0.848b only

Published 2008-04-30. Last modified 2026-06-16.