CVE-2009-2588

Hotscripts Type PHP Clone Script - XSS

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Moudi · textwebappsphp
https://www.exploit-db.com/exploits/34776
exploitdb WRITEUP VERIFIED
by Moudi · textwebappsphp
https://www.exploit-db.com/exploits/34775
exploitdb WORKING POC VERIFIED
by Moudi · textwebappsphp
https://www.exploit-db.com/exploits/34774

References (7)

Core 7
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1979
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/51911
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35892
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/56167
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/56168
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/56169

Scores

EPSS 0.0199
EPSS Percentile 83.7%

Details

CWE
CWE-79
Status published
Products (1)
resalecode/hotscripts_type_php_clone_script
Published Jul 24, 2009
Tracked Since Feb 18, 2026