CVE-2009-2602 EXPLOIT
5.0
MEDIUM · CVSS 2.0 · EPSS 2.2% (pctl 82)
Patch early
A public exploit exists.
Description
R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.
Scoring
| CVSS | 5.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| EPSS | 2.23% — more likely to be exploited than 82% of all CVEs |
| Weakness | CWE-264 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-07-27 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| r2newsletter | r2 newsletter lite |
| r2newsletter | r2 newsletter pro |
| r2newsletter | r2 newsletter stats |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | R2 NewsLetter Lite/Pro/Stats - 'admin.mdb' Database Disclosure | 2009-06-01 |
References
→ the Explorer · watch your stack · NVD