CVE-2008-2192: Itcms

High severity, CVSS 10.0. EPSS: 3.7% chance of exploitation in the next 30 days.

Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inject arbitrary PHP code into box/MiniChat/data/shouts.php via the shout parameter.

Affected products

• Itcms Itcms: version 1.9 only

Published 2008-05-14. Last modified 2026-06-16.