medium
4.3
CWE
79
Advisory Published
CVE Published
Updated

CVE-2009-4780: XSS

First published: Wed Apr 21 2010(Updated: )

Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
phpMyFAQ=1.1.4
phpMyFAQ=2.0.14
phpMyFAQ=1.4.10
phpMyFAQ=1.1.0
phpMyFAQ=1.5.7
phpMyFAQ=1.1.2
phpMyFAQ=1.3.10
phpMyFAQ=1.2.3
phpMyFAQ=2.0.9
phpMyFAQ=1.3.6
phpMyFAQ=1.3.13
phpMyFAQ=1.6.5
phpMyFAQ=1.5-beta2
phpMyFAQ=1.3.3
phpMyFAQ=2.0.12
phpMyFAQ=1.5.9
phpMyFAQ=1.0.1
phpMyFAQ=1.4-alpha2
phpMyFAQ=1.5-beta3
phpMyFAQ=1.6.11
phpMyFAQ=0.65
phpMyFAQ=1.5-rc2
phpMyFAQ=0.70
phpMyFAQ=1.6.9
phpMyFAQ=0.95
phpMyFAQ=2.5.2
phpMyFAQ=1.5.1
phpMyFAQ=2.0.4
phpMyFAQ=2.5.3
phpMyFAQ=1.3.7
phpMyFAQ=1.3.9
phpMyFAQ=1.4.0
phpMyFAQ=1.6.10
phpMyFAQ=1.5.3
phpMyFAQ=1.3.11
phpMyFAQ=2.0.3
phpMyFAQ=0.60
phpMyFAQ=2.0.6
phpMyFAQ<=2.5.4
phpMyFAQ=1.4.3
phpMyFAQ=1.4-alpha1
phpMyFAQ=1.3.4
phpMyFAQ=1.4.2
phpMyFAQ=0.87
phpMyFAQ=1.0.1a
phpMyFAQ=2.0.5
phpMyFAQ=1.3.8
phpMyFAQ=1.1.3
phpMyFAQ=2.0.11
phpMyFAQ=1.5-rc3
phpMyFAQ=1.1.5
phpMyFAQ=1.4.6
phpMyFAQ=1.5-beta1
phpMyFAQ=1.1.1
phpMyFAQ=0.85
phpMyFAQ=1.2.0
phpMyFAQ=1.4.9
phpMyFAQ=1.3.9-pl1
phpMyFAQ=1.3.14
phpMyFAQ=2.0.17
phpMyFAQ=1.5.2
phpMyFAQ=1.5.8
phpMyFAQ=0.80a
phpMyFAQ=1.5-alpha2
phpMyFAQ=1.4
phpMyFAQ=1.6.2
phpMyFAQ=1.2.5a
phpMyFAQ=0.90
phpMyFAQ=1.4.4
phpMyFAQ=1.6.8
phpMyFAQ=1.3.2
phpMyFAQ=1.5-alpha1
phpMyFAQ=1.4.8
phpMyFAQ=1.5-rc4
phpMyFAQ=1.4.0a
phpMyFAQ=1.2.1
phpMyFAQ=1.3.1
phpMyFAQ=2.0.0
phpMyFAQ=1.6.1
phpMyFAQ=2.0.15
phpMyFAQ=2.5.1
phpMyFAQ=1.5.4
phpMyFAQ=1.6.4
phpMyFAQ=1.4.7
phpMyFAQ=1.2.4
phpMyFAQ=1.6.12
phpMyFAQ=1.4.1
phpMyFAQ=1.5-rc5
phpMyFAQ=1.6.7
phpMyFAQ=1.5.5
phpMyFAQ=0.80
phpMyFAQ=1.4.11
phpMyFAQ=1.4.5
phpMyFAQ=1.3.0
phpMyFAQ=1.2.5b
phpMyFAQ=1.5.0
phpMyFAQ=1.1.4a
phpMyFAQ=1.3.12
phpMyFAQ=1.6.3
phpMyFAQ=2.0.13
phpMyFAQ=1.5.6
phpMyFAQ=2.0.8
phpMyFAQ=2.0.16
phpMyFAQ=2.0.1
phpMyFAQ=2.0.10
phpMyFAQ=1.0
phpMyFAQ=2.0.7
phpMyFAQ=0.86
phpMyFAQ=2.5.0
phpMyFAQ=1.5
phpMyFAQ=1.5-rc1
phpMyFAQ=1.2.2
phpMyFAQ=1.3.5
phpMyFAQ=0.666
phpMyFAQ=1.6.6
phpMyFAQ=2.0.2
phpMyFAQ=1.4a
phpMyFAQ=1.2.5
phpMyFAQ=1.6.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2009-4780?

    CVE-2009-4780 is categorized as a moderate severity vulnerability due to its potential impact on the application.

  • How do I fix CVE-2009-4780?

    To fix CVE-2009-4780, upgrade to phpMyFAQ version 2.5.5 or later, which addresses the cross-site scripting vulnerabilities.

  • What types of vulnerabilities does CVE-2009-4780 include?

    CVE-2009-4780 includes multiple cross-site scripting (XSS) vulnerabilities that allow attackers to inject arbitrary web scripts or HTML.

  • Which versions of phpMyFAQ are affected by CVE-2009-4780?

    CVE-2009-4780 affects multiple versions of phpMyFAQ prior to 2.5.5.

  • What impact can CVE-2009-4780 have on my system?

    Exploitation of CVE-2009-4780 can lead to unauthorized access to user data and potentially allow for malicious actions from the affected system.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203