# CVEs published 2009-12-22 25 CVEs were published on December 22, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-4379](https://cve.now/CVE-2009-4379.md): Multiple cross-site scripting (XSS) vulnerabilities in Valarsoft Webmatic before 3.0.3 allow remote attackers to inject arbitrary web script (no CVSS) - [CVE-2009-4380](https://cve.now/CVE-2009-4380.md): Multiple SQL injection vulnerabilities in Valarsoft Webmatic before 3.0.3 allow remote attackers to execute arbitrary SQL commands via unspe (no CVSS) - [CVE-2009-4381](https://cve.now/CVE-2009-4381.md): Cross-site scripting (XSS) vulnerability in index.php in texmedia Million Pixel Script 3 allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2009-4382](https://cve.now/CVE-2009-4382.md): Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2009-4383](https://cve.now/CVE-2009-4383.md): Directory traversal vulnerability in Pforum.php in Rocomotion P forum before 1.28 allows remote attackers to read arbitrary files via direct (no CVSS) - [CVE-2009-4384](https://cve.now/CVE-2009-4384.md): Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2009-4385](https://cve.now/CVE-2009-4385.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the au (no CVSS) - [CVE-2009-4386](https://cve.now/CVE-2009-4386.md): SQL injection vulnerability in hotel\_tiempolibre\_ext.php in Venalsur Booking Centre Booking System for Hotels Group, when magic\_quotes\_gpc i (no CVSS) - [CVE-2009-4387](https://cve.now/CVE-2009-4387.md): The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Buil (no CVSS) - [CVE-2009-4388](https://cve.now/CVE-2009-4388.md): Cross-site scripting (XSS) vulnerability in the ListMan (nl\_listman) extension 1.2.1 for TYPO3 allows remote attackers to inject arbitrary w (no CVSS) - [CVE-2009-4389](https://cve.now/CVE-2009-4389.md): Unspecified vulnerability in the Watchdog (aba\_watchdog) extension 2.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive i (no CVSS) - [CVE-2009-4390](https://cve.now/CVE-2009-4390.md): SQL injection vulnerability in the Car (car) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspeci (no CVSS) - [CVE-2009-4391](https://cve.now/CVE-2009-4391.md): Cross-site scripting (XSS) vulnerability in the File list (dr\_blob) extension 2.1.1 for TYPO3 allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2009-4392](https://cve.now/CVE-2009-4392.md): SQL injection vulnerability in the XDS Staff List (xds\_staff) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbit (no CVSS) - [CVE-2009-4393](https://cve.now/CVE-2009-4393.md): SQL injection vulnerability in the Document Directorys (danp\_documentdirs) extension 1.10.7 and earlier for TYPO3 allows remote attackers to (no CVSS) - [CVE-2009-4394](https://cve.now/CVE-2009-4394.md): SQL injection vulnerability in the Random Prayer 2 (ste\_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute ar (no CVSS) - [CVE-2009-4395](https://cve.now/CVE-2009-4395.md): Cross-site scripting (XSS) vulnerability in the Random Prayer 2 (ste\_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers (no CVSS) - [CVE-2009-4396](https://cve.now/CVE-2009-4396.md): SQL injection vulnerability in the Diocese of Portsmouth Resources Database (pd\_resources) extension 0.1.1 and earlier for TYPO3 allows remo (no CVSS) - [CVE-2009-4397](https://cve.now/CVE-2009-4397.md): Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Resources Database (pd\_resources) extension 0.1.1 and earlier for TYPO (no CVSS) - [CVE-2009-4398](https://cve.now/CVE-2009-4398.md): Cross-site scripting (XSS) vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs\_religiousartgallery) extension 0.1.2 and (no CVSS) - [CVE-2009-4399](https://cve.now/CVE-2009-4399.md): SQL injection vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs\_religiousartgallery) extension 0.1.2 and earlier for (no CVSS) - [CVE-2009-4400](https://cve.now/CVE-2009-4400.md): Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste\_parish\_admin) extension 0.1.3 and earlier for TYPO3 allo (no CVSS) - [CVE-2009-4401](https://cve.now/CVE-2009-4401.md): SQL injection vulnerability in the Parish Administration Database (ste\_parish\_admin) extension 0.1.3 and earlier for TYPO3 allows remote att (no CVSS) - [CVE-2009-4140](https://cve.now/CVE-2009-4140.md): Unrestricted file upload vulnerability in ofc\_upload\_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0 (no CVSS) - [CVE-2009-3702](https://cve.now/CVE-2009-3702.md): Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbitrary local files via (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-12-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.