CVE-2009-1554

Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise Server and other products, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 string in the PATH_INFO, which is displayed on the 404 error page, as demonstrated by the PATH_INFO to theme/META-INF.

• CWE-79

• http://dsecrg.com/pages/vul/show.php?id=138Exploit
• http://osvdb.org/54220
• http://secunia.com/advisories/35006
• http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlExploit
• http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
• http://www.securityfocus.com/archive/1/503239/100/0/threaded
• http://www.securityfocus.com/bid/34829Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50336
• https://woodstock.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=4041Patch, Vendor Advisory
• http://dsecrg.com/pages/vul/show.php?id=138Exploit
• http://osvdb.org/54220
• http://secunia.com/advisories/35006
• http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.htmlExploit
• http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html
• http://www.securityfocus.com/archive/1/503239/100/0/threaded
• http://www.securityfocus.com/bid/34829Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50336
• https://woodstock.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=4041Patch, Vendor Advisory

Published

May 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1548SQL injection vulnerability in index.php in BluSky CMS allow…
• CVE-2009-1549AGTC MyShop 3.2b allows remote attackers to bypass authentic…
• CVE-2009-1550Zakkis Technology ABC Advertise 1.0 does not properly restri…
• CVE-2009-1551Multiple PHP remote file inclusion vulnerabilities in Qt qui…
• CVE-2009-1552Unspecified vulnerability in the IGMP driver in SCO Unixware…
• CVE-2009-1553Multiple cross-site scripting (XSS) vulnerabilities in the A…
• CVE-2009-1555The Cisco Linksys WVC54GCA wireless video camera with firmwa…
• CVE-2009-1556img/main.cgi on the Cisco Linksys WVC54GCA wireless video ca…
• CVE-2009-1557Multiple cross-site scripting (XSS) vulnerabilities on the C…
• CVE-2009-1558Directory traversal vulnerability in adm/file.cgi on the Cis…
• CVE-2009-1559Absolute path traversal vulnerability in adm/file.cgi on the…
• CVE-2009-1560The Cisco Linksys WVC54GCA wireless video camera with firmwa…