peter bassill · operator
$ cve CVE-2009-2780 JSON

CVE-2009-2780 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 2.2% (pctl 82)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to category.php, view parameter to (2) login.php and (3) viewlisting.php, page parameter to (4) searchresults.php and (5) toplistings.php, and (6) member parameter to viewmember.php.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS2.24% — more likely to be exploited than 82% of all CVEs
WeaknessCWE-79
On CISA KEVno
Public exploityes
Published2009-08-17
Last modified2026-06-16

Affected (1)

VendorProduct
68 classifieds68 classifieds

Public exploits

SourceTitleDate
exploit-db68 Classifieds 4.1 - 'category.php' Cross-Site Scripting2009-07-27
exploit-db68 Classifieds 4.1 - 'login.php' Cross-Site Scripting2009-07-27
exploit-db68 Classifieds 4.1 - 'searchresults.php' Cross-Site Scripting2009-07-27
exploit-db68 Classifieds 4.1 - 'toplistings.php' Cross-Site Scripting2009-07-27
exploit-db68 Classifieds 4.1 - 'viewlisting.php' Cross-Site Scripting2009-07-27
exploit-db68 Classifieds 4.1 - 'viewmember.php' Cross-Site Scripting2009-07-27

References

→ the Explorer  ·  watch your stack  ·  NVD