CVE-2009-1729

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6...

4.3 MediumPublic exploit

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Address Book component or (2) the temporaryCalendars parameter to uwc/base/UWCMain.

Exploit likelihood

5.33%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2009-1729
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-1729
Updated: 2026-11-02

EUVDEUVD-2009-1724 No score

Record: EUVD-2009-1724
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qvcw-3p9h-gm33 No score

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6...

Record: GHSA-qvcw-3p9h-gm33
Weakness: CWE-79
Updated: 2026-11-02

Affected products

sun java system communications express

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Sun Java System Communications Express 6.3 - 'search.xml' Cross-Site Scripting	2009-05-20
Exploit-DB	Sun Java System Communications Express 6.3 - 'UWCMain' Cross-Site Scripting	2009-05-20

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1729 is a medium vulnerability (CVSS 4.3) in Sun Java System Communications Express, published May 21, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.33%, the 92nd percentile. No source names a fixed version.

References

Show 9 moreShow less