# CVEs published 2009-10-26

15 CVEs were published on October 26, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3778](https://cve.now/CVE-2009-3778.md): SQL injection vulnerability in Moodle Course List 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-3779](https://cve.now/CVE-2009-3779.md): Cross-site scripting (XSS) vulnerability in vCard 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to (no CVSS)
- [CVE-2009-3780](https://cve.now/CVE-2009-3780.md): Cross-site scripting (XSS) vulnerability in Abuse 5.x before 5.x-2.1 and 6.x before 6.x-1.1-alpha1, a module for Drupal, allows remote attac (no CVSS)
- [CVE-2009-3781](https://cve.now/CVE-2009-3781.md): The filefield\_file\_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal c (no CVSS)
- [CVE-2009-3782](https://cve.now/CVE-2009-3782.md): Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with "View own userpoints (no CVSS)
- [CVE-2009-3783](https://cve.now/CVE-2009-3783.md): Cross-site scripting (XSS) vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject (no CVSS)
- [CVE-2009-3784](https://cve.now/CVE-2009-3784.md): Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to a (no CVSS)
- [CVE-2009-3785](https://cve.now/CVE-2009-3785.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote at (no CVSS)
- [CVE-2009-3786](https://cve.now/CVE-2009-3786.md): Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, a (no CVSS)
- [CVE-2009-3787](https://cve.now/CVE-2009-3787.md): files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file paramete (no CVSS)
- [CVE-2009-3788](https://cve.now/CVE-2009-3788.md): SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmuser (aka (no CVSS)
- [CVE-2009-3789](https://cve.now/CVE-2009-3789.md): Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2009-3790](https://cve.now/CVE-2009-3790.md): Heap-based buffer overflow in FormMax (formerly AcroForm) evaluation 3.5 allows remote attackers to cause a denial of service or possibly ex (no CVSS)
- [CVE-2009-3611](https://cve.now/CVE-2009-3611.md): common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup s (no CVSS)
- [CVE-2009-3625](https://cve.now/CVE-2009-3625.md): Directory traversal vulnerability in www/index.php in Sahana 0.6.2.2 allows remote attackers to include and execute arbitrary local files vi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-10-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.