CVEvulnerability
CVE-2009-5142
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-08-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.
Affected configurations
• binarymoon timthumb (<= 1.09)
• prothemedesign mimbo pro 2.3.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html Exploit
- http://www.osvdb.org/71878 www.osvdb.org
- https://code.google.com/p/timthumb/issues/detail?id=49 Exploit
- https://code.google.com/p/timthumb/source/detail?r=65 Patch
- http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html Exploit
- http://www.osvdb.org/71878 www.osvdb.org
- https://code.google.com/p/timthumb/issues/detail?id=49 Exploit
- https://code.google.com/p/timthumb/source/detail?r=65 Patch