# CVEs published 2009-09-23 29 CVEs were published on September 23, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-3306](https://cve.now/CVE-2009-3306.md): PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via… (no CVSS) - [CVE-2009-3307](https://cve.now/CVE-2009-3307.md): Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the… (no CVSS) - [CVE-2009-3308](https://cve.now/CVE-2009-3308.md): SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows remote attackers to execute arbitrary SQL commands via the listingid… (no CVSS) - [CVE-2009-3309](https://cve.now/CVE-2009-3309.md): SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta allows remote attackers to execute arbitrary SQL commands via the itemid… (no CVSS) - [CVE-2009-3310](https://cve.now/CVE-2009-3310.md): SQL injection vulnerability in index.php in Zainu 1.0 allows remote attackers to execute arbitrary SQL commands via the album\_id parameter… (no CVSS) - [CVE-2009-3311](https://cve.now/CVE-2009-3311.md): Cross-site scripting (XSS) vulnerability in index.php in RSSMediaScript allows remote attackers to inject arbitrary web script or HTML via… (no CVSS) - [CVE-2009-3312](https://cve.now/CVE-2009-3312.md): PHP remote file inclusion vulnerability in php/init.poll.php in phpPollScript 1.3 and earlier, when register\_globals is enabled, allows… (no CVSS) - [CVE-2009-3313](https://cve.now/CVE-2009-3313.md): Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to… (no CVSS) - [CVE-2009-3314](https://cve.now/CVE-2009-3314.md): SQL injection vulnerability in ladders.php in Elite Gaming Ladders 3.2 allows remote attackers to execute arbitrary SQL commands via the… (no CVSS) - [CVE-2009-3315](https://cve.now/CVE-2009-3315.md): SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attackers to execute… (no CVSS) - [CVE-2009-3316](https://cve.now/CVE-2009-3316.md): SQL injection vulnerability in the JReservation (com\_jreservation) component 1.0 and 1.5 for Joomla! allows remote attackers to execute… (no CVSS) - [CVE-2009-3317](https://cve.now/CVE-2009-3317.md): PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to execute arbitrary… (no CVSS) - [CVE-2009-3318](https://cve.now/CVE-2009-3318.md): Directory traversal vulnerability in the Roland Breedveld Album (com\_album) component 1.14 for Joomla! allows remote attackers to access… (no CVSS) - [CVE-2009-3319](https://cve.now/CVE-2009-3319.md): SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id… (no CVSS) - [CVE-2009-3320](https://cve.now/CVE-2009-3320.md): Cross-site scripting (XSS) vulnerability in scrivi.php in Zenas PaoLink (aka Pao-Link) 1.0 allows remote attackers to inject arbitrary web… (no CVSS) - [CVE-2009-3321](https://cve.now/CVE-2009-3321.md): SQL injection vulnerability in SaphpLesson 4.3, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary SQL… (no CVSS) - [CVE-2009-3322](https://cve.now/CVE-2009-3322.md): The Siemens Gigaset SE361 WLAN router allows remote attackers to cause a denial of service (device reboot) via a flood of crafted TCP… (no CVSS) - [CVE-2009-3323](https://cve.now/CVE-2009-3323.md): Multiple PHP remote file inclusion vulnerabilities in BAnner ROtation System mini (BAROSmini) 0.32.595 allow remote attackers to execute… (no CVSS) - [CVE-2009-3324](https://cve.now/CVE-2009-3324.md): PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers to execute… (no CVSS) - [CVE-2009-3325](https://cve.now/CVE-2009-3325.md): SQL injection vulnerability in the Focusplus Developments Survey Manager (com\_surveymanager) component 1.5.0 for Joomla! allows remote… (no CVSS) - [CVE-2009-3326](https://cve.now/CVE-2009-3326.md): SQL injection vulnerability in index.php in CMScontrol Content Management System 7.x allows remote attackers to execute arbitrary SQL… (no CVSS) - [CVE-2009-3327](https://cve.now/CVE-2009-3327.md): Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the (1) QUERY… (no CVSS) - [CVE-2009-3328](https://cve.now/CVE-2009-3328.md): Cross-site scripting (XSS) vulnerability in sign.php in WX-Guestbook 1.1.208 allows remote attackers to inject arbitrary web script or… (no CVSS) - [CVE-2009-3329](https://cve.now/CVE-2009-3329.md): Stack-based buffer overflow in Winplot 1.25.0.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Plot2D… (no CVSS) - [CVE-2009-3330](https://cve.now/CVE-2009-3330.md): SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic\_quotes\_gpc is disabled, allows remote attackers to execute… (no CVSS) - [CVE-2009-3331](https://cve.now/CVE-2009-3331.md): Multiple PHP remote file inclusion vulnerabilities in DDL CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the… (no CVSS) - [CVE-2009-3332](https://cve.now/CVE-2009-3332.md): SQL injection vulnerability in the JBudgetsMagic (com\_jbudgetsmagic) component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to… (no CVSS) - [CVE-2009-3333](https://cve.now/CVE-2009-3333.md): PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com\_koesubmit) component 1.0 for Mambo allows remote attackers… (no CVSS) - [CVE-2009-3334](https://cve.now/CVE-2009-3334.md): SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component (aka JINC or com\_jinc) component 0.2… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2009-09-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.