CVE-2009-1366

Dotnetnuke < 4.9.2 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Website\admin\Sales\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "name/value pairs" and "paypal IPN functionality."

References (3)

[Vendor Advisory] http://secunia.com/advisories/34686

[Vendor Advisory] http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno25/tabid/1260/Default.aspx

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/34484

Scores

EPSS 0.0032

EPSS Percentile 54.9%

Classification

CWE

CWE-79

Status published

Affected Products (31)

dotnetnuke/dotnetnuke < 4.9.2

dotnetnuke/dotnetnuke

... and 16 more

Timeline

Published Apr 22, 2009

Tracked Since Feb 18, 2026