CVE-2009-3581
Sql-ledger - XSS
Title source: ruleDescription
Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts Payable menu item for Add Transaction, or the name field in (3) the Customers menu item for Add Customer or (4) the Vendor menu item for Add Vendor.
References (4)
Scores
EPSS
0.0030
EPSS Percentile
52.6%
Classification
CWE
CWE-79
Status
published
Affected Products (2)
sql-ledger/sql-ledger
n/a/n/a
Timeline
Published
Dec 23, 2009
Tracked Since
Feb 18, 2026