CVE-2009-0026
Apache Jackrabbit contains Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
- Record
CVE-2009-0026- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
- Record
CVE-2009-0026- Updated
- 2026-11-02
EUVDEUVD-2022-2785 No score
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
- Record
EUVD-2022-2785- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6fxv-38xc-h866 No score
Apache Jackrabbit contains Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
- Record
GHSA-6fxv-38xc-h866- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6fxv-38xc-h866 No score
Apache Jackrabbit contains Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
- Record
GHSA-6fxv-38xc-h866- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jackrabbit:jackrabbitMaven |
before 1.5.2 | 1.5.2 |
org.apache.jackrabbit:jackrabbitMaven |
before 1.5.2, plus listed versions 1.2.11.2.21.2.31.31.3.11.3.31.41.5.0 |
1.5.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache JackRabbit 1.4/1.5 Content Repository (JCR) - 'search.jsp?q' Cross-Site Scripting | 2009-01-20 |
| Exploit-DB | Apache JackRabbit 1.4/1.5 Content Repository (JCR) - 'swr.jsp?q' Cross-Site Scripting | 2009-01-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0026 is a medium vulnerability (CVSS 4.3) in Apache Jackrabbit, published January 21, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 26.8%, the 98th percentile. Fixed in org.apache.jackrabbit:jackrabbit 1.5.2.
References
securityreason.com/securityalert/4942
securityfocus.com/archive/1/500196/100/0/threaded
apache.org/dist/jackrabbit/RELEASE-NOTES-1.5.2.txt
exchange.xforce.ibmcloud.com/vulnerabilities/48110
secunia.com/advisories/33576
issues.apache.org/jira/browse/JCR-1925
Show 8 moreShow less
vupen.com/english/advisories/2009/0177
nvd.nist.gov/vuln/detail/CVE-2009-0026
github.com/apache/jackrabbit/commit/36330ae8df40ceaddf9f3f95b8d4855b54921579
access.redhat.com/security/cve/CVE-2009-0026
bugzilla.redhat.com/show_bug.cgi?id=481126