Read the docs
TI-2008-06780 Aliases CVE-2008-7092GHSA-527v-75q9-6w5g

Multiple cross-site scripting (XSS) vulnerabilities in Unica Affinium Campaign 7.2.1.0.55…

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to inject arbitrary web script or HTML via a Javascript event in the (1) url, (2) PageName, and (3) title parameters in a CustomBookMarkLink action to Campaign/Campaign; (4) a Javascript event in the displayIcon parameter to Campaign/updateOfferTemplateSubmit.do (aka the templates web page); (5) crafted input to Campaign/CampaignListener (aka the listener server), which is not properly handled when displaying the status log; and (6) id parameter to Campaign/campaignDetails.do, (7) id parameter to Campaign/offerDetails.do, (8) function parameter to Campaign/Campaign, (9) sessionID parameter to Campaign/runAllFlowchart.do, (10) id parameter in an edit action to Campaign/updateOfferTemplatePage.do, (11) Frame parameter in a LoadFrame action to Campaign/Campaign, (12) affiniumUserName parameter to manager/jsp/test.jsp, (13) affiniumUserName parameter to Campaign/main.do, and possibly other vectors.

Why it matters now

EPSS 0.01774 78th percentileScored 2026-11-07
Public exploit Yes 11 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:unica:affinium_campaign:7.2.1.0.55:*:*:*:*:*:*:*7.2.1.0.55VulnerableUnica
  • cpe:2.3:a:unica:affinium_campaign:7.2.1.0.55:*:*:*:*:*:*:* Versions 7.2.1.0.55 Vulnerable ·Unica

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-7092
  2. 2026-10-03 Alias added: GHSA-527v-75q9-6w5g

References

Exploit 11

Other 2

  • TI-2008-06781 Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow… CVSS 2.0MEDIUM 6.8
  • TI-2008-06782 Campaign/CampaignListener in the listener server in Unica Affinium Campaign 7.2.1.0.55… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences