Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-0026

CWE-79 — Cross-site Scripting (XSS)9 documents7 sources
Severity
4.3MEDIUM
EPSS
40.1%
top 2.66%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apache Jackrabbit
Timeline
PublishedJan 21
Latest updateMay 2

Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDapache/jackrabbit1.4, 1.5.0+1

🔴Vulnerability Details

3
GHSA
Apache Jackrabbit contains Cross-site Scripting↗2022-05-02
▶
OSV
Apache Jackrabbit contains Cross-site Scripting↗2022-05-02
▶
CVEList
CVE-2009-0026: Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1↗2009-01-21
▶

💥Exploits & PoCs

2
Exploit-DB
Apache JackRabbit 1.4/1.5 Content Repository (JCR) - 'swr.jsp?q' Cross-Site Scripting↗2009-01-20
▶
Exploit-DB
Apache JackRabbit 1.4/1.5 Content Repository (JCR) - 'search.jsp?q' Cross-Site Scripting↗2009-01-20
▶

📋Vendor Advisories

1
Red Hat
JackRabbit XSS in examples↗2009-01-20
▶

💬Community

2
Bugzilla
Moodle: Multiple security fixes in 1.9.7 and 1.8.11 upstream releases↗2009-12-06
▶
Bugzilla
CVE-2009-0026 JackRabbit XSS in examples↗2009-01-22
▶
CVE-2009-0026 (MEDIUM CVSS 4.3) | Multiple cross-site scripting (XSS) | cvebase.io