CVE-2008-4448: Positive Software H-Sphere

Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the (1) overkill, (2) futils, or (3) edit actions.

Affected products

• Positive Software H-Sphere: version 4.3.10 only

Published 2008-10-06. Last modified 2026-06-16.