# CVEs published 2009-03-20

31 CVEs were published on March 20, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6500](https://cve.now/CVE-2008-6500.md): Cross-site scripting (XSS) vulnerability in CodeToad ASP Shopping Cart Script allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-6501](https://cve.now/CVE-2008-6501.md): Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-6502](https://cve.now/CVE-2008-6502.md): Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an av (no CVSS)
- [CVE-2008-6503](https://cve.now/CVE-2008-6503.md): Multiple cross-site scripting (XSS) vulnerabilities in PrestaShop 1.1.0.3 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-1032](https://cve.now/CVE-2009-1032.md): SQL injection vulnerability in gallery\_list.php in YABSoft Advanced Image Hosting (AIH) Script 2.3 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2009-1033](https://cve.now/CVE-2009-1033.md): SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder (no CVSS)
- [CVE-2009-1034](https://cve.now/CVE-2009-1034.md): SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows rem (no CVSS)
- [CVE-2009-1035](https://cve.now/CVE-2009-1035.md): Cross-site scripting (XSS) vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupa (no CVSS)
- [CVE-2009-1036](https://cve.now/CVE-2009-1036.md): Cross-site request forgery (CSRF) vulnerability in the Plus 1 module before 6.x-2.6, a module for Drupal, allows remote attackers to cast vo (no CVSS)
- [CVE-2009-1037](https://cve.now/CVE-2009-1037.md): Unspecified vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6. (no CVSS)
- [CVE-2009-1038](https://cve.now/CVE-2009-1038.md): Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image\_id param (no CVSS)
- [CVE-2009-1039](https://cve.now/CVE-2009-1039.md): Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file. (no CVSS)
- [CVE-2009-1040](https://cve.now/CVE-2009-1040.md): Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file. (no CVSS)
- [CVE-2008-6492](https://cve.now/CVE-2008-6492.md): Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uplo (no CVSS)
- [CVE-2008-6493](https://cve.now/CVE-2008-6493.md): Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, which allows remote att (no CVSS)
- [CVE-2008-6494](https://cve.now/CVE-2008-6494.md): ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl (no CVSS)
- [CVE-2008-6495](https://cve.now/CVE-2008-6495.md): Cross-site scripting (XSS) vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows (no CVSS)
- [CVE-2008-6496](https://cve.now/CVE-2008-6496.md): Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT eXPert PDF EditorX a (no CVSS)
- [CVE-2008-6497](https://cve.now/CVE-2008-6497.md): The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTTP requests for the / (no CVSS)
- [CVE-2008-6498](https://cve.now/CVE-2008-6498.md): Cross-site request forgery (CSRF) vulnerability in security/xamppsecurity.php in XAMPP 1.6.8 allows remote attackers to hijack the authentic (no CVSS)
- [CVE-2008-6499](https://cve.now/CVE-2008-6499.md): security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows remote attackers to sp (no CVSS)
- [CVE-2009-1022](https://cve.now/CVE-2009-1022.md): Heap-based buffer overflow in the Preview/ Set Segment function in Gretech GOMlab GOM Encoder 1.0.0.11 and earlier allows user-assisted remo (no CVSS)
- [CVE-2009-1023](https://cve.now/CVE-2009-1023.md): SQL injection vulnerability in index.php in phpComasy 0.9.1 allows remote attackers to execute arbitrary SQL commands via the entry\_id param (no CVSS)
- [CVE-2009-1024](https://cve.now/CVE-2009-1024.md): Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL commands via the linkid p (no CVSS)
- [CVE-2009-1025](https://cve.now/CVE-2009-1025.md): PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2009-1026](https://cve.now/CVE-2009-1026.md): Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2009-1027](https://cve.now/CVE-2009-1027.md): SQL injection vulnerability in OpenCart 1.1.8 allows remote attackers to execute arbitrary SQL commands via the order parameter. (no CVSS)
- [CVE-2009-1028](https://cve.now/CVE-2009-1028.md): Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file. (no CVSS)
- [CVE-2009-1029](https://cve.now/CVE-2009-1029.md): Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header, r (no CVSS)
- [CVE-2009-1030](https://cve.now/CVE-2009-1030.md): Cross-site scripting (XSS) vulnerability in the choose\_primary\_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before (no CVSS)
- [CVE-2009-1031](https://cve.now/CVE-2009-1031.md): Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.