# CVEs published 2009-04-28

26 CVEs were published on April 28, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2438](https://cve.now/CVE-2008-2438.md): Integer overflow in ovalarmsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute… (no CVSS)
- [CVE-2008-6757](https://cve.now/CVE-2008-6757.md): Cross-site scripting (XSS) vulnerability in manuals\_search.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to inject… (no CVSS)
- [CVE-2008-6758](https://cve.now/CVE-2008-6758.md): Cross-site request forgery (CSRF) vulnerability in cart\_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to hijack… (no CVSS)
- [CVE-2008-6759](https://cve.now/CVE-2008-6759.md): ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a URL in the POST\_DATA parameter to… (no CVSS)
- [CVE-2008-6760](https://cve.now/CVE-2008-6760.md): ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for… (no CVSS)
- [CVE-2008-6761](https://cve.now/CVE-2008-6761.md): Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject arbitrary PHP code… (no CVSS)
- [CVE-2008-6762](https://cve.now/CVE-2008-6762.md): Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary… (no CVSS)
- [CVE-2008-6763](https://cve.now/CVE-2008-6763.md): login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrary account by… (no CVSS)
- [CVE-2008-6764](https://cve.now/CVE-2008-6764.md): Cross-site scripting (XSS) vulnerability in login.php in Silentum LoginSys 1.0.0 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2008-6765](https://cve.now/CVE-2008-6765.md): ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to access the contents of an arbitrary shopping cart via a modified cart\_name… (no CVSS)
- [CVE-2008-6766](https://cve.now/CVE-2008-6766.md): cart\_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to cause a denial of service (excessive shopping carts) via a… (no CVSS)
- [CVE-2008-6767](https://cve.now/CVE-2008-6767.md): wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of… (no CVSS)
- [CVE-2009-1452](https://cve.now/CVE-2009-1452.md): Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP… (no CVSS)
- [CVE-2009-1453](https://cve.now/CVE-2009-1453.md): SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic\_quotes\_gpc is disabled, allows remote attackers to… (no CVSS)
- [CVE-2009-1454](https://cve.now/CVE-2009-1454.md): Cross-site scripting (XSS) vulnerability in tasks.php in WebCollab before 2.50 (aka Billy Goat) allows remote attackers to inject… (no CVSS)
- [CVE-2009-1455](https://cve.now/CVE-2009-1455.md): Multiple cross-site request forgery (CSRF) vulnerabilities in WebCollab before 2.50 (aka Billy Goat) allow remote attackers to hijack the… (no CVSS)
- [CVE-2009-1456](https://cve.now/CVE-2009-1456.md): Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary… (no CVSS)
- [CVE-2009-1457](https://cve.now/CVE-2009-1457.md): Cross-site scripting (XSS) vulnerability in player.php in Nuke Evolution Xtreme 2.x allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2009-1458](https://cve.now/CVE-2009-1458.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary… (no CVSS)
- [CVE-2009-1459](https://cve.now/CVE-2009-1459.md): Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2009-1460](https://cve.now/CVE-2009-1460.md): razorCMS before 0.4 uses weak permissions for (1) admin/core/admin\_config.php, which allows local users to obtain the administrator's… (no CVSS)
- [CVE-2009-1461](https://cve.now/CVE-2009-1461.md): Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to… (no CVSS)
- [CVE-2009-1462](https://cve.now/CVE-2009-1462.md): The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is… (no CVSS)
- [CVE-2009-1463](https://cve.now/CVE-2009-1463.md): Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving… (no CVSS)
- [CVE-2009-1450](https://cve.now/CVE-2009-1450.md): PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in… (no CVSS)
- [CVE-2009-1451](https://cve.now/CVE-2009-1451.md): Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary web script or HTML… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2009-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.