CVE-2009-10001

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2. This vulnerability affects unknown code of the file example-form.php. The manipulation of the argument captcha with the input %3Cscript%3Ealert(1)%3C/script%3E leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.3 is able to address this issue. The name of the patch is c84fb6b153bebaf228feee0cbf50728d27ae3f80. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218296.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
jianlinwei	cool-php-captcha	0.1; 0.2

References

https://github.com/jianlinwei/cool-php-captcha/commit/c84fb6b153bebaf228feee0cbf50728d27ae3f80Patch, Third Party Advisory
https://github.com/jianlinwei/cool-php-captcha/issues/2Exploit, Issue Tracking, Third Party Advisory
https://github.com/jianlinwei/cool-php-captcha/releases/tag/0.3Release Notes, Third Party Advisory
https://vuldb.com/?ctiid.218296Exploit, Third Party Advisory
https://vuldb.com/?id.218296Exploit, Third Party Advisory
https://github.com/jianlinwei/cool-php-captcha/commit/c84fb6b153bebaf228feee0cbf50728d27ae3f80Patch, Third Party Advisory
https://github.com/jianlinwei/cool-php-captcha/issues/2Exploit, Issue Tracking, Third Party Advisory
https://github.com/jianlinwei/cool-php-captcha/releases/tag/0.3Release Notes, Third Party Advisory
https://vuldb.com/?ctiid.218296Exploit, Third Party Advisory
https://vuldb.com/?id.218296Exploit, Third Party Advisory

Timeline

Published: Jan 13, 2023
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-100026.1A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr. This issue affects some unknown processing of the CVE-2009-100036.1A vulnerability was found in capnsquarepants wordcraft up to 0.6. It has been classified as problematic. Affected is an unknown function of CVE-2009-100046.1A vulnerability was found in Turante Sandbox Theme up to 1.5.2. It has been classified as problematic. This affects the function sandbox_bod CVE-2009-100058.7ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, all CVE-2009-100069.3UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When th CVE-2009-100079.1Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentica CVE-2009-10015.5Unspecified vulnerability in Oracle BEA WebLogic Portal 8.1 Gold through SP6 allows remote authenticated users to gain privileges via unknow CVE-2009-10025.8Unspecified vulnerability in Oracle BEA WebLogic Server 10.3, 10.0 Gold through MP1, 9.2 Gold through MP3, 9.1, 9.0, 8.1 Gold through SP6, a CVE-2009-10035.0Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attacker CVE-2009-10044.0Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality and i CVE-2009-10054.1Unspecified vulnerability in the Oracle Data Service Integrator (AquaLogic Data Services Platform) component in BEA Product Suite 10.3.0, 3.CVE-2009-100610.0Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, a