# CVEs published 2009-03-26

13 CVEs were published on March 26, 2009: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-6529](https://cve.now/CVE-2008-6529.md): Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2008-6530](https://cve.now/CVE-2008-6530.md): Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to… (no CVSS)
- [CVE-2008-6531](https://cve.now/CVE-2008-6531.md): The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via… (no CVSS)
- [CVE-2008-6532](https://cve.now/CVE-2008-6532.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote… (no CVSS)
- [CVE-2008-6533](https://cve.now/CVE-2008-6533.md): Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content… (no CVSS)
- [CVE-2008-6534](https://cve.now/CVE-2008-6534.md): Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands… (no CVSS)
- [CVE-2008-6535](https://cve.now/CVE-2008-6535.md): admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password… (no CVSS)
- [CVE-2008-6528](https://cve.now/CVE-2008-6528.md): NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to the URL, which… (no CVSS)
- [CVE-2009-1148](https://cve.now/CVE-2009-1148.md): Directory traversal vulnerability in bs\_disp\_as\_mime\_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote… (no CVSS)
- [CVE-2009-1149](https://cve.now/CVE-2009-1149.md): CRLF injection vulnerability in bs\_disp\_as\_mime\_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote… (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2009-1150](https://cve.now/CVE-2009-1150.md): Multiple cross-site scripting (XSS) vulnerabilities in the export page (display\_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and… (no CVSS)
- [CVE-2009-1151](https://cve.now/CVE-2009-1151.md): Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inje (CVSS 9.8, KEV)
- [CVE-2009-1152](https://cve.now/CVE-2009-1152.md): Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a denial of service… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2009-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.