CVE-2009-2109

Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to charts.php and the (2) fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php.

• CWE-22

• http://osvdb.org/55166Broken Link
• http://osvdb.org/55196Broken Link
• http://secunia.com/advisories/35492Vendor Advisory
• https://www.exploit-db.com/exploits/8979Third Party Advisory, VDB Entry
• http://osvdb.org/55166Broken Link
• http://osvdb.org/55196Broken Link
• http://secunia.com/advisories/35492Vendor Advisory
• https://www.exploit-db.com/exploits/8979Third Party Advisory, VDB Entry

Published

Jun 18, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2103SQL injection vulnerability in the Frontend MP3 Player (fe_m…
• CVE-2009-2104Cross-site scripting (XSS) vulnerability in the Modern Guest…
• CVE-2009-2105SQL injection vulnerability in the References database (t3re…
• CVE-2009-2106SQL injection vulnerability in the Virtual Civil Services (c…
• CVE-2009-2107Multiple cross-site scripting (XSS) vulnerabilities in index…
• CVE-2009-2108git-daemon in git 1.4.4.5 through 1.6.3 allows remote attack…
• CVE-2009-2110Multiple directory traversal vulnerabilities in DB Top Sites…
• CVE-2009-2111Static code injection vulnerability in add_reg.php in DB Top…
• CVE-2009-2112Directory traversal vulnerability in include/page_bottom.php…
• CVE-2009-2113Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow…
• CVE-2009-2114Multiple cross-site scripting (XSS) vulnerabilities in admin…
• CVE-2009-2115admin.php in SkyBlueCanvas 1.1 r237 allows remote authentica…