CVE-2009-0455

Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username parameter to comment.php.

• CWE-79

• http://secunia.com/advisories/33878Vendor Advisory
• http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf
• http://www.glfusion.org/article.php/xsscommentsVendor Advisory
• http://www.securityfocus.com/bid/33683Exploit, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48603
• http://secunia.com/advisories/33878Vendor Advisory
• http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf
• http://www.glfusion.org/article.php/xsscommentsVendor Advisory
• http://www.securityfocus.com/bid/33683Exploit, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48603

Published

Feb 11, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0449Buffer overflow in klim5.sys in Kaspersky Anti-Virus for Wor…
• CVE-2009-0450Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 an…
• CVE-2009-0451SQL injection vulnerability in Skalfa SkaLinks 1.5 allows re…
• CVE-2009-0452Multiple SQL injection vulnerabilities in parents/login.php …
• CVE-2009-0453Online Grades 3.2.4 allows remote attackers to obtain config…
• CVE-2009-0454Multiple SQL injection vulnerabilities in DMXReady Online No…
• CVE-2009-0456PHP remote file inclusion vulnerability in examples/example_…
• CVE-2009-0457Multiple directory traversal vulnerabilities in AJA Portal 1…
• CVE-2009-0458Multiple SQL injection vulnerabilities in admin/login_submit…
• CVE-2009-0459Multiple SQL injection vulnerabilities in admin/login_submit…
• CVE-2009-0460Whole Hog Ware Support 1.x allows remote attackers to bypass…
• CVE-2009-0461Whole Hog Password Protect: Enhanced 1.x allows remote attac…