CVE-2009-3949: cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote…

PriorityP353high7.5CVSS 2.0

AVNACLAuNCPIPAP

EXPLOIT

EPSS

2.20%

80.3th percentile

cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackers to create administrative accounts via the name, password, and conf_password parameters.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
vivaprograms	infinity_script	<= 2.0.5	—
vivaprograms	infinity_script	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.