CVE-2009-4025

Argument injection vulnerability in the traceroute function in Traceroute.php in the...

10.0 High

Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information.

Exploit likelihood

6.15%Up 2.4 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Record: CVE-2009-4025
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4025
Updated: 2026-11-02

EUVDEUVD-2009-3996 No score

Record: EUVD-2009-3996
Updated: 2026-11-03

GitHub AdvisoriesGHSA-54vq-c3mg-r28r No score

Argument injection vulnerability in the traceroute function in Traceroute.php in the...

Record: GHSA-54vq-c3mg-r28r
Weakness: CWE-78
Updated: 2026-11-02

Affected products

pear

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4025 is a high vulnerability (CVSS 10.0) in Pear, published November 28, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.15%, the 93rd percentile. No source names a fixed version.

References

Show 10 moreShow less