Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in ACG-PTP 1.0.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Category name field under Advertisement Packages, the (2) Reason field under Credit/Debit Users, and the (3) FAQ question and (4) FAQ answer fields under Add New FAQ Entry.
Conclusion & alert: CVE-2008-3782 is rated Low Risk (28.2/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.20%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-03-17 | 0.10% | 0.20% | +0.10% |
| 2 | 2023-03-07 | 1.13% | 0.10% | -1.03% |
| 3 | 2022-02-04 | — | 1.13% | — |
Full EPSS history (3 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 3.5 | 2.0 | LOW |
|
6.8 | 2.9 | [email protected] |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| discountedscripts | acg_ptp | 1.0.6 | cpe:2.3:a:discountedscripts:acg_ptp:1.0.6:*:*:*:*:*:*:* |