CVE-2009-2078

Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) node title and (2) node body in a tree root page.

• CWE-79

• http://drupal.org/node/487810Patch, Vendor Advisory
• http://drupal.org/node/487812Patch, Vendor Advisory
• http://drupal.org/node/487828Patch, Vendor Advisory
• http://secunia.com/advisories/35421Vendor Advisory
• http://www.securityfocus.com/bid/35287Patch
• http://drupal.org/node/487810Patch, Vendor Advisory
• http://drupal.org/node/487812Patch, Vendor Advisory
• http://drupal.org/node/487828Patch, Vendor Advisory
• http://secunia.com/advisories/35421Vendor Advisory
• http://www.securityfocus.com/bid/35287Patch

Published

Jun 16, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2072Apple Safari does not require a cached certificate before di…
• CVE-2009-2073Cross-site request forgery (CSRF) vulnerability in Linksys W…
• CVE-2009-2074Cross-site scripting (XSS) vulnerability in Nodequeue 5.x be…
• CVE-2009-2075Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a modul…
• CVE-2009-2076Cross-site scripting (XSS) vulnerability in Views 6.x before…
• CVE-2009-2077Drupal 6.x before 6.x-2.6, a module for Drupal, allows remot…
• CVE-2009-2079Cross-site scripting (XSS) vulnerability in the administrati…
• CVE-2009-2080admin.php in MRCGIGUY The Ticket System 2.0 does not properl…
• CVE-2009-2081Directory traversal vulnerability in help.php in phpWebThing…
• CVE-2009-2082SQL injection vulnerability in insidepage.php in Creative We…
• CVE-2009-2083Cross-site scripting (XSS) vulnerability in the term data de…
• CVE-2009-2084Simple Linux Utility for Resource Management (SLURM) 1.2 and…