CVE-2009-3789

Public Exploit

Description

Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5) category.php, (6) department.php, (7) profile.php, (8) rejects.php, (9) search.php, (10) toBePublished.php, (11) user.php, and (12) view_file.php; and (13) the caller parameter in a Modify User action to user.php.

Category

4.3
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 3.54% Top 15%
Vendor Advisory secunia.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://osvdb.org/59302 vdb entry
http://osvdb.org/59307 vdb entry
http://www.securityfocus.com/bid/36777 exploit vdb entry patch
http://osvdb.org/59309 vdb entry
http://osvdb.org/59304 vdb entry
http://osvdb.org/59311 vdb entry
http://osvdb.org/59310 vdb entry
http://osvdb.org/59308 vdb entry
http://secunia.com/advisories/30750 third party advisory vendor advisory
http://www.packetstormsecurity.org/0910-exploits/opendocman-sqlxss.txt exploit
http://osvdb.org/59303 vdb entry
http://osvdb.org/59305 vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/53887 vdb entry
http://osvdb.org/59306 vdb entry
http://osvdb.org/59312 vdb entry

Frequently Asked Questions

What is the severity of CVE-2009-3789?
CVE-2009-3789 has been scored as a medium severity vulnerability.
How to fix CVE-2009-3789?
To fix CVE-2009-3789, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-3789 being actively exploited in the wild?
It is possible that CVE-2009-3789 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.