CVE-2008-3887: Dotproject

Medium severity, CVSS 6.0. EPSS: 0.9% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the user_id parameter in a viewuser action.

Affected products

• Dotproject Dotproject: version 2.1.2 only

Published 2008-09-02. Last modified 2026-06-16.