# CVEs published 2009-09-23

29 CVEs were published on September 23, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3306](https://cve.now/CVE-2009-3306.md): PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2009-3307](https://cve.now/CVE-2009-3307.md): Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the FSPH (no CVSS)
- [CVE-2009-3308](https://cve.now/CVE-2009-3308.md): SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows remote attackers to execute arbitrary SQL commands via the listingid p (no CVSS)
- [CVE-2009-3309](https://cve.now/CVE-2009-3309.md): SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta allows remote attackers to execute arbitrary SQL commands via the itemid pa (no CVSS)
- [CVE-2009-3310](https://cve.now/CVE-2009-3310.md): SQL injection vulnerability in index.php in Zainu 1.0 allows remote attackers to execute arbitrary SQL commands via the album\_id parameter i (no CVSS)
- [CVE-2009-3311](https://cve.now/CVE-2009-3311.md): Cross-site scripting (XSS) vulnerability in index.php in RSSMediaScript allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2009-3312](https://cve.now/CVE-2009-3312.md): PHP remote file inclusion vulnerability in php/init.poll.php in phpPollScript 1.3 and earlier, when register\_globals is enabled, allows remo (no CVSS)
- [CVE-2009-3313](https://cve.now/CVE-2009-3313.md): Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to (1 (no CVSS)
- [CVE-2009-3314](https://cve.now/CVE-2009-3314.md): SQL injection vulnerability in ladders.php in Elite Gaming Ladders 3.2 allows remote attackers to execute arbitrary SQL commands via the pla (no CVSS)
- [CVE-2009-3315](https://cve.now/CVE-2009-3315.md): SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2009-3316](https://cve.now/CVE-2009-3316.md): SQL injection vulnerability in the JReservation (com\_jreservation) component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbi (no CVSS)
- [CVE-2009-3317](https://cve.now/CVE-2009-3317.md): PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2009-3318](https://cve.now/CVE-2009-3318.md): Directory traversal vulnerability in the Roland Breedveld Album (com\_album) component 1.14 for Joomla! allows remote attackers to access arb (no CVSS)
- [CVE-2009-3319](https://cve.now/CVE-2009-3319.md): SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id p (no CVSS)
- [CVE-2009-3320](https://cve.now/CVE-2009-3320.md): Cross-site scripting (XSS) vulnerability in scrivi.php in Zenas PaoLink (aka Pao-Link) 1.0 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2009-3321](https://cve.now/CVE-2009-3321.md): SQL injection vulnerability in SaphpLesson 4.3, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-3322](https://cve.now/CVE-2009-3322.md): The Siemens Gigaset SE361 WLAN router allows remote attackers to cause a denial of service (device reboot) via a flood of crafted TCP packet (no CVSS)
- [CVE-2009-3323](https://cve.now/CVE-2009-3323.md): Multiple PHP remote file inclusion vulnerabilities in BAnner ROtation System mini (BAROSmini) 0.32.595 allow remote attackers to execute arb (no CVSS)
- [CVE-2009-3324](https://cve.now/CVE-2009-3324.md): PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2009-3325](https://cve.now/CVE-2009-3325.md): SQL injection vulnerability in the Focusplus Developments Survey Manager (com\_surveymanager) component 1.5.0 for Joomla! allows remote attac (no CVSS)
- [CVE-2009-3326](https://cve.now/CVE-2009-3326.md): SQL injection vulnerability in index.php in CMScontrol Content Management System 7.x allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2009-3327](https://cve.now/CVE-2009-3327.md): Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the (1) QUERY pa (no CVSS)
- [CVE-2009-3328](https://cve.now/CVE-2009-3328.md): Cross-site scripting (XSS) vulnerability in sign.php in WX-Guestbook 1.1.208 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-3329](https://cve.now/CVE-2009-3329.md): Stack-based buffer overflow in Winplot 1.25.0.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Plot2D (.wp2) (no CVSS)
- [CVE-2009-3330](https://cve.now/CVE-2009-3330.md): SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2009-3331](https://cve.now/CVE-2009-3331.md): Multiple PHP remote file inclusion vulnerabilities in DDL CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the wwwR (no CVSS)
- [CVE-2009-3332](https://cve.now/CVE-2009-3332.md): SQL injection vulnerability in the JBudgetsMagic (com\_jbudgetsmagic) component 0.3.2 through 0.4.0 for Joomla! allows remote attackers to ex (no CVSS)
- [CVE-2009-3333](https://cve.now/CVE-2009-3333.md): PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com\_koesubmit) component 1.0 for Mambo allows remote attackers to (no CVSS)
- [CVE-2009-3334](https://cve.now/CVE-2009-3334.md): SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component (aka JINC or com\_jinc) component 0.2 for (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.