$ cve CVE-2009-4908 JSON

CVE-2009-4908 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.6% (pctl 76)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the (1) commentName, (2) commentEmail, (3) commentWeb, or (4) commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via the (5) article_id or (6) title parameter to admin/write.php, the (7) category_id or (8) category_name parameter to admin/groups.php, the (9) blogroll_id or (10) title parameter to admin/blogroll.php, or the (11) blog_name or (12) tag_line parameter to admin/settings.php.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.65% — more likely to be exploited than 76% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2010-06-25
Last modified	2026-06-16

Affected (1)

Vendor	Product
dootzky	oblog

Public exploits

Source	Title	Date
exploit-db	oBlog - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Brute Force	2009-12-11

References

→ the Explorer · watch your stack · NVD