CVE-2009-1845

Lussumo Vanilla - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Gerendi Sandor Attila · textwebappsphp

https://www.exploit-db.com/exploits/33013

View Code ZIP pw:eip

References (4)

[Exploit] http://gsasec.blogspot.com/2009/05/vanilla-v117-cross-site-scripting.html

[Patch, Vendor Advisory] http://lussumo.com/community/discussion/9524/vanilla-118-released/#Item_0

[Vendor Advisory] http://secunia.com/advisories/35234

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/503847/100/0/threaded

Scores

EPSS 0.0096

EPSS Percentile 76.2%

Classification

CWE

CWE-79

Status published

Affected Products (3)

lussumo/vanilla

n/a/n/a

Timeline

Published Jun 01, 2009

Tracked Since Feb 18, 2026