Unscored severity · published Aug 25, 2010
CVE-2009-4994
Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the…
–
CVSS
1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Smartertrack · Smartertools
through 4.0.3483; 3.0.3040; 3.1.3050; 3.1.3089; 3.5.3126; 3.5.3159; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4994
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4994
holisticinfosec.org
http://holisticinfosec.org/content/view/123/45/
Vendor Advisory
http://secunia.com/advisories/36172
Patch
http://www.smartertools.com/SmarterTrack/ReleaseNotes.aspx
More from Smartertrack
7.2
CVE-2022-24387
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g
6.5
CVE-2022-24385
A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010
6.1
CVE-2022-24386
Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010
6.1
CVE-2022-24384
Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010
5.3
CVE-2020-36926
SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details