CVE-2009-4159

TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

0.84%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2009-4159
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4159
Updated: 2026-11-02

EUVDEUVD-2009-4129 No score

Record: EUVD-2009-4129
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7x6f-jvmg-6fgp 2.1

TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)

Record: GHSA-7x6f-jvmg-6fgp
CVSS 4.0: 2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-7x6f-jvmg-6fgp 2.1

TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)

Record: GHSA-7x6f-jvmg-6fgp
CVSS 4.0: 2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

ivan kartolo direct mail

Affected packages

Affected packages
Package	Affected	Fixed
`directmailteam/direct-mail` Packagist	before 2.6.5	2.6.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4159 is a low vulnerability (CVSS 3.5) in Ivan Kartolo Direct Mail, published December 2, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in directmailteam/direct-mail 2.6.5.