CVE-2010-2509

2daybiz Web Template Software - Cross-Site Scripting via Category Keyword or Member Login Password Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-2509. PoCs published by Sangteamtham.

AI-analyzed exploit summary The exploit demonstrates SQL injection and XSS vulnerabilities in 2daybiz Web Template Software. It includes specific HTTP requests and payloads for both SQLi and XSS attacks.

Description

Multiple cross-site scripting (XSS) vulnerabilities in 2daybiz Web Template Software allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to category.php and the (2) password parameter to memberlogin.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Sangteamtham · textwebappsphp

https://www.exploit-db.com/exploits/14020

View Code ZIP pw:eip

The exploit demonstrates SQL injection and XSS vulnerabilities in 2daybiz Web Template Software. It includes specific HTTP requests and payloads for both SQLi and XSS attacks.

Classification

Working Poc 90%

Attack Type

Sqli | Xss

Complexity

Trivial

Reliability

Reliable

Target: 2daybiz Web Template Software

No auth needed

Prerequisites: Access to the target web application

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/40348

Exploit exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/14020

Scores

EPSS 0.0119

EPSS Percentile 63.9%

Details

CWE

CWE-79

Status published

Products (1)

2daybiz/web_template_software

Published Jun 28, 2010

Tracked Since Feb 18, 2026