CVE-2008-7208: Insane Visions Onecms

Medium severity, CVSS 6.8. EPSS: 1.8% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username parameter ($usernameb variable) to a_login.php or (2) user parameter to staff.php.

Affected products

• Insane Visions Onecms: up to and including 2.4

Published 2009-09-11. Last modified 2026-06-16.