VULNERABILITY INTELLIGENCE

CVE-2009-0673

CVSS score6.5 MEDIUM
EPSS probability2.65%
CISA KEVNot currently listed
Published2009-02-22
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:P/A:P

Description

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references