CVE-2009-2076

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

• CWE-79

• http://drupal.org/node/488068Patch, Vendor Advisory
• http://drupal.org/node/488082Patch
• http://lampsecurity.org/drupal-views-xss-vulnerabilityExploit, URL Repurposed
• http://secunia.com/advisories/35425Vendor Advisory
• http://www.securityfocus.com/bid/35304
• http://drupal.org/node/488068Patch, Vendor Advisory
• http://drupal.org/node/488082Patch
• http://lampsecurity.org/drupal-views-xss-vulnerabilityExploit, URL Repurposed
• http://secunia.com/advisories/35425Vendor Advisory
• http://www.securityfocus.com/bid/35304

Published

Jun 16, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2070Opera displays a cached certificate for a (1) 4xx or (2) 5xx…
• CVE-2009-2071Google Chrome before 1.0.154.53 displays a cached certificat…
• CVE-2009-2072Apple Safari does not require a cached certificate before di…
• CVE-2009-2073Cross-site request forgery (CSRF) vulnerability in Linksys W…
• CVE-2009-2074Cross-site scripting (XSS) vulnerability in Nodequeue 5.x be…
• CVE-2009-2075Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a modul…
• CVE-2009-2077Drupal 6.x before 6.x-2.6, a module for Drupal, allows remot…
• CVE-2009-2078Multiple cross-site scripting (XSS) vulnerabilities in Bookt…
• CVE-2009-2079Cross-site scripting (XSS) vulnerability in the administrati…
• CVE-2009-2080admin.php in MRCGIGUY The Ticket System 2.0 does not properl…
• CVE-2009-2081Directory traversal vulnerability in help.php in phpWebThing…
• CVE-2009-2082SQL injection vulnerability in insidepage.php in Creative We…