Unscored severity · published Aug 31, 2009
CVE-2009-3021
Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package of Geeklog 1.5.0 through 1.5.2 and when…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package of Geeklog 1.5.0 through 1.5.2 and when distributed 20090629 or earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geeklog · Geeklog
1.5.0; 1.5.1; 1.5.2 · source: NVD
MY
Mycaljp · Yoshinori Tahara
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3021
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3021
jvn.jp
http://jvn.jp/en/jp/JVN20478978/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000055.html
Vendor Advisory
http://secunia.com/advisories/36404
Vendor Advisory
http://secunia.com/advisories/36413
www.geeklog.jp
http://www.geeklog.jp/article.php/20090820020302431
More from Geeklog
4.8
CVE-2023-46058
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the…
4.8
CVE-2023-46059
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL…
4.8
CVE-2023-37787
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and…
4.8
CVE-2023-37786
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail…
–
CVE-2013-1470
Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject…