$ cve CVE-2009-1584 JSON

CVE-2009-1584 EXPLOIT

6.0

MEDIUM · CVSS 2.0 · EPSS 2.6% (pctl 85)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) mail, (2) password, and (3) letra parameters to index.php; (4) y and (5) m parameters to sobre.php; and the (6) dcTema, (7) madsTema, (8) zthesTema, (9) skosTema, and (10) xtmTema parameters to xml.php.

Scoring

CVSS	6.0 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS	2.61% — more likely to be exploited than 85% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2009-05-07
Last modified	2026-06-16

Affected (1)

Vendor	Product
r020	tematres

Public exploits

Source	Title	Date
exploit-db	TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting	2009-05-05
exploit-db	TemaTres 1.0.3 - Blind SQL Injection	2009-05-05

References

→ the Explorer · watch your stack · NVD