VULNERABILITY INTELLIGENCE

CVE-2009-2736

CVSS score6.5 MEDIUM
EPSS probability4.82%
CISA KEVNot currently listed
Published2009-08-11
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:P/A:P

Description

Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references