Unscored severity · published Jan 21, 2009
CVE-2009-0026
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1)…
–
CVSS
26.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
Exploitation
Is it being used?
Exploit prediction (EPSS)26.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jackrabbit · Apache
1.4; 1.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0026
Vendor Advisory
http://secunia.com/advisories/33576
securityreason.com
http://securityreason.com/securityalert/4942
www.apache.org
http://www.apache.org/dist/jackrabbit/RELEASE-NOTES-1.5.2.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/500196/100/0/threaded
Exploit
http://www.securityfocus.com/bid/33360
www.vupen.com
http://www.vupen.com/english/advisories/2009/0177
More from Jackrabbit
9.8
CVE-2023-37895
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable…
9.1
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
8.8
CVE-2025-53689
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges
8.8
CVE-2016-6801
Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before…
6.5
CVE-2025-58782
Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons