CVE-2009-0417

Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.

• CWE-79

• http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerabilityPatch, Vendor Advisory
• http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerabilityPatch, Vendor Advisory
• http://trac.agavi.org/ticket/1019Vendor Advisory
• http://www.securityfocus.com/bid/33826
• http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerabilityPatch, Vendor Advisory
• http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerabilityPatch, Vendor Advisory
• http://trac.agavi.org/ticket/1019Vendor Advisory
• http://www.securityfocus.com/bid/33826

Published

Feb 10, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0411Google Chrome before 1.0.154.46 does not properly restrict a…
• CVE-2009-0412The ProcessLogin function in class.auth.php in Interspire Sh…
• CVE-2009-0413Cross-site scripting (XSS) vulnerability in RoundCube Webmai…
• CVE-2009-0414Unspecified vulnerability in Tor before 0.2.0.33 has unspeci…
• CVE-2009-0415Untrusted search path vulnerability in trickle 1.07 allows l…
• CVE-2009-0416The SSL certificate setup program (genSslCert.sh) in Standar…
• CVE-2009-0418The IPv6 Neighbor Discovery Protocol (NDP) implementation in…
• CVE-2009-0419Microsoft XML Core Services, as used in Microsoft Expression…
• CVE-2009-0420SQL injection vulnerability in the RD-Autos (com_rdautos) 1.…
• CVE-2009-0421SQL injection vulnerability in the Eventing (com_eventing) 1…
• CVE-2009-0422Dynamic variable evaluation vulnerability in lists/admin.php…
• CVE-2009-0423Directory traversal vulnerability in index.php in Php Photo …