CVE-2009-4589

Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.

• CWE-79

• http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-July/000087.html
• http://osvdb.org/55824Exploit
• http://secunia.com/advisories/35818Vendor Advisory
• http://www.securityfocus.com/bid/35662Patch
• http://www.vupen.com/english/advisories/2009/1882Patch, Vendor Advisory
• https://bugzilla.wikimedia.org/show_bug.cgi?id=19693
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51687
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-July/000087.html
• http://osvdb.org/55824Exploit
• http://secunia.com/advisories/35818Vendor Advisory
• http://www.securityfocus.com/bid/35662Patch
• http://www.vupen.com/english/advisories/2009/1882Patch, Vendor Advisory
• https://bugzilla.wikimedia.org/show_bug.cgi?id=19693
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51687

Published

Jan 7, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4583SQL injection vulnerability in the DhForum (com_dhforum) com…
• CVE-2009-4584admin.php in dB Masters Multimedia Links Directory 3.1.3 all…
• CVE-2009-4585UranyumSoft Listing Service stores sensitive information und…
• CVE-2009-4586Multiple cross-site scripting (XSS) vulnerabilities in index…
• CVE-2009-4587Cherokee Web Server 0.5.4 allows remote attackers to cause a…
• CVE-2009-4588Heap-based buffer overflow in the WindsPlayerIE.View.1 Activ…
• CVE-2009-4590Cross-site scripting (XSS) vulnerability in base_local_rules…
• CVE-2009-4591SQL injection vulnerability in Basic Analysis and Security E…
• CVE-2009-4592Unspecified vulnerability in base_local_rules.php in Basic A…
• CVE-2009-4593The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.…
• CVE-2009-4594Unspecified vulnerability in IBM Lotus iNotes (aka Domino We…
• CVE-2009-4595SQL injection vulnerability in index.php in PHP Inventory 1.…