{"id":"CVE-2009-1767","aliases":["EUVD-2009-1762","GHSA-q6mr-4q5f-3vh6"],"status":"published","title":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative...","description":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02084,"percentile":0.81692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2009-05-22T18:00:00Z","modified":"2026-06-16T23:08:01Z","exploits":[{"source":"exploitdb","id":"EDB-8691","title":"2DayBiz Template Monster Clone - 'edituser.php' Change Pass","type":"webapps","platform":"php","date":"2009-05-14","verified":true,"url":"https://www.exploit-db.com/exploits/8691"}],"products":[{"vendor":"2daybiz","product":"template_monster_clone"}],"references":[{"url":"http://www.securityfocus.com/bid/34977","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://secunia.com/advisories/35090","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/8691","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50561","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1767"},{"url":"https://github.com/advisories/GHSA-q6mr-4q5f-3vh6"}],"sources":{"cve":[{"id":"CVE-2009-1767","description":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.","status":"published","published":"2009-05-22T18:00:00Z","modified":"2024-08-07T05:27:53.673Z","updated_at":"2026-11-02T14:33:25.126493Z"}],"euvd":[{"id":"EUVD-2009-1762","description":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.","status":"published","published":"2009-05-22T18:00:00Z","modified":"2024-08-07T05:27:53Z","updated_at":"2026-11-03T01:39:20.465485Z"}],"ghsa":[{"id":"GHSA-q6mr-4q5f-3vh6","title":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative...","description":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.","status":"published","published":"2022-05-02T03:28:20Z","modified":"2023-01-31T05:08:04Z","updated_at":"2026-11-02T14:49:19.883163Z"}],"nvd":[{"id":"CVE-2009-1767","description":"admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.","status":"published","published":"2009-05-22T18:30:00.28Z","modified":"2026-06-16T23:08:01.01Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:35.136779Z"}]}}