{"id":"CVE-2009-1938","aliases":["EUVD-2009-1933","GHSA-x5hg-hv2j-7wv6"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers...","description":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04304,"percentile":0.91214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2009-06-05T18:13:00Z","modified":"2026-06-16T23:08:23Z","exploits":[{"source":"exploitdb","id":"EDB-33022","title":"Joomla! \u003c 1.5.11 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities","type":"webapps","platform":"php","date":"2009-06-03","verified":true,"url":"https://www.exploit-db.com/exploits/33022"}],"products":[{"vendor":"joomla","product":"joomla"}],"references":[{"url":"http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50923","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/bid/35189","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch"]},{"url":"http://secunia.com/advisories/35278","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://developer.joomla.org/security/news/297-20090602-core-frontend-xss.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/54868","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2009/1497","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1938"},{"url":"https://github.com/advisories/GHSA-x5hg-hv2j-7wv6"}],"sources":{"cve":[{"id":"CVE-2009-1938","description":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.","status":"published","published":"2009-06-05T18:13:00Z","modified":"2024-08-07T05:27:54.978Z","updated_at":"2026-11-02T14:33:25.516454Z"}],"euvd":[{"id":"EUVD-2009-1933","description":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.","status":"published","published":"2009-06-05T18:13:00Z","modified":"2024-08-07T05:27:54Z","updated_at":"2026-11-03T01:39:19.419771Z"}],"ghsa":[{"id":"GHSA-x5hg-hv2j-7wv6","title":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers...","description":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.","status":"published","published":"2022-05-02T03:30:03Z","modified":"2023-01-31T05:08:33Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:49:25.206701Z"}],"nvd":[{"id":"CVE-2009-1938","description":"Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.","status":"published","published":"2009-06-05T18:30:00.217Z","modified":"2026-06-16T23:08:23.85Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:35.733785Z"}]}}