Every CVESearch/Get API key

CVE-2009-4856

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows...

4.3 MediumPublic exploit

CVE-2009-4856 is a medium vulnerability (CVSS 4.3) in Ecomstudio Php Easy Shopping Cart, published May 10, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. No source names a fixed version.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
1.50%EPSS, 74th percentile
Exploitation
None known1 public exploit
Fixed in
No fix listedNo source names one

Description

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Exploit likelihood

1.50%Down 0.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHP Easy Shopping Cart 3.1R - 'subitems.php' Cross-Site Scripting2009-08-07

What each source reports

NVD Score used4.3

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Record
CVE-2009-4856
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Record
CVE-2009-4856
Updated
2026-11-02
EUVDEUVD-2009-4819No score

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Record
EUVD-2009-4819
Updated
2026-11-03
GitHub AdvisoriesGHSA-hx6r-5mcv-8mm3No score

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows...

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Record
GHSA-hx6r-5mcv-8mm3
Weakness
CWE-79
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open