Unrated severityNVD Advisory· Published Nov 25, 2008· Updated Apr 23, 2026

CVE-2008-5221

Description

The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.

Affected products

Wportfolio/Wportfolio2 versions
cpe:2.3:a:wportfolio:wportfolio:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wportfolio:wportfolio:*:*:*:*:*:*:*:*range: <=0.3
- cpe:2.3:a:wportfolio:wportfolio:0.2:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.securityfocus.com/bid/32384nvdExploit
securityreason.com/securityalert/4631nvd
www.vupen.com/english/advisories/2008/3219nvd
exchange.xforce.ibmcloud.com/vulnerabilities/46772nvd
www.exploit-db.com/exploits/7170nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000