CVE-2008-5219 — The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters

Back Back to CVE browser

HIGH

The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters

Published Nov 25, 2008

7.5

HIGH

CVSS 2.0

EPSS 6.85%

Description

The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters.

Affected products

Remediation

No remediation recorded yet.

Metrics

6.85% 0.06850

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.06850

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	6.85% (0.06850)	93.84th	v5 (v2026.06.15)
Jun 15, 2026	6.85% (0.06850)	93.19th	v5 (v2026.06.15)
Jan 15, 2026	3.58% (0.03579)	87.39th	v4 (v2025.03.14)
Mar 30, 2025	2.21% (0.02210)	82.98th	v4 (v2025.03.14)
Mar 29, 2025	4.14% (0.04137)	80.75th	v4 (v2025.03.14)
Mar 17, 2025	2.12% (0.02118)	82.95th	v4 (v2025.03.14)
Dec 12, 2024	2.22% (0.02217)	89.89th	v3 (v2023.03.01)
Jul 11, 2024	2.13% (0.02129)	89.32th	v3 (v2023.03.01)
Apr 30, 2024	1.80% (0.01796)	87.97th	v3 (v2023.03.01)
Jul 6, 2023	2.04% (0.02039)	87.39th	v3 (v2023.03.01)
May 26, 2023	1.65% (0.01655)	85.72th	v3 (v2023.03.01)
Apr 14, 2023	1.36% (0.01364)	84.18th	v3 (v2023.03.01)
Mar 7, 2023	1.00% (0.01000)	81.29th	v3 (v2023.03.01)
Mar 6, 2023	4.19% (0.04187)	87.39th	v2 (v2022.01.01)
Apr 1, 2022	4.19% (0.04187)	86.11th	v2 (v2022.01.01)
Feb 4, 2022	4.19% (0.04187)	69.86th	v2 (v2022.01.01)

Weaknesses (1)

CWE-287

Improper Authentication

References (4)

http://osvdb.org/49885
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/32718
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/4634
third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7149
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://osvdb.org/49885		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/32718		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/4634		third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7149		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 25, 2008

Updated Aug 7, 2024

Reserved Nov 25, 2008

Link CVE-2008-5219

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2008-5219

Red Hat

Severity n/a

Public date n/a

Links CVE-2008-5219