# CVEs published 2009-10-08

13 CVEs were published on October 8, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3591](https://cve.now/CVE-2009-3591.md): Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location. (no CVSS)
- [CVE-2009-3592](https://cve.now/CVE-2009-3592.md): Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-3593](https://cve.now/CVE-2009-3593.md): Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2009-3594](https://cve.now/CVE-2009-3594.md): Cross-site scripting (XSS) vulnerability in bpost.php in BLOB Blog System before 1.2 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-3595](https://cve.now/CVE-2009-3595.md): SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat\_ID parame (no CVSS)
- [CVE-2009-3596](https://cve.now/CVE-2009-3596.md): JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication an (no CVSS)
- [CVE-2009-3597](https://cve.now/CVE-2009-3597.md): Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow (no CVSS)
- [CVE-2009-3598](https://cve.now/CVE-2009-3598.md): Cross-site scripting (XSS) vulnerability in survey\_result.php in eCardMAX FormXP 2007 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-3599](https://cve.now/CVE-2009-3599.md): Cross-site scripting (XSS) vulnerability in single\_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2009-3600](https://cve.now/CVE-2009-3600.md): HUBScript 1.0 allows remote attackers to obtain configuration information via a direct request to manage/phpinfo.php, which calls the phpinf (no CVSS)
- [CVE-2009-3601](https://cve.now/CVE-2009-3601.md): Cross-site scripting (XSS) vulnerability in demo\_page.php in Scriptsez Ultimate Poll allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-3590](https://cve.now/CVE-2009-3590.md): SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands via the Cat\_ID parame (no CVSS)
- [CVE-2009-3589](https://cve.now/CVE-2009-3589.md): incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run wi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.