CVEvulnerability
CVE-2009-1408
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-04-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags.
Affected configurations
• webspell webspell 4.2.0c
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://osvdb.org/53782 osvdb.org
- http://secunia.com/advisories/34764 Vendor Advisory
- http://www.securityfocus.com/archive/1/502732/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/34595 Exploit, Patch
- http://www.webspell.org/index.php?site=files&file=25 Patch, Vendor Advisory
- http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49937 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/8453 www.exploit-db.com
- http://osvdb.org/53782 osvdb.org
- http://secunia.com/advisories/34764 Vendor Advisory
- http://www.securityfocus.com/archive/1/502732/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/34595 Exploit, Patch
- http://www.webspell.org/index.php?site=files&file=25 Patch, Vendor Advisory
- http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49937 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/8453 www.exploit-db.com