CVE-2009-1408

Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags.

• CWE-79

• http://osvdb.org/53782
• http://secunia.com/advisories/34764Vendor Advisory
• http://www.securityfocus.com/archive/1/502732/100/0/threaded
• http://www.securityfocus.com/bid/34595Exploit, Patch
• http://www.webspell.org/index.php?site=files&file=25Patch, Vendor Advisory
• http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=ukPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49937
• https://www.exploit-db.com/exploits/8453
• http://osvdb.org/53782
• http://secunia.com/advisories/34764Vendor Advisory
• http://www.securityfocus.com/archive/1/502732/100/0/threaded
• http://www.securityfocus.com/bid/34595Exploit, Patch
• http://www.webspell.org/index.php?site=files&file=25Patch, Vendor Advisory
• http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=ukPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49937
• https://www.exploit-db.com/exploits/8453

Published

Apr 24, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1394Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 o…
• CVE-2009-1403SQL injection vulnerability in product_info.php in CRE Loade…
• CVE-2009-1404SQL injection vulnerability in admin.php in PastelCMS 0.8.0,…
• CVE-2009-1405Directory traversal vulnerability in index.php in PastelCMS …
• CVE-2009-1406Directory traversal vulnerability in cms_detect.php in Total…
• CVE-2009-1407Directory traversal vulnerability in config.php in NotFTP 1.…
• CVE-2009-1409SQL injection vulnerability in usersettings.php in e107 0.7.…
• CVE-2009-1410SQL injection vulnerability in index.php in Quick.Cms.Lite 0…
• CVE-2009-1411SQL injection vulnerability in events/inc/events.inc.php in …
• CVE-2009-1412Argument injection vulnerability in the chromehtml: protocol…
• CVE-2009-1413Google Chrome 1.0.x does not cancel timeouts upon a page tra…
• CVE-2009-1414Google Chrome 2.0.x lets modifications to the global object …