CVE-2009-4365

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.92%

Published

Dec 21, 2009

Modified

Apr 22, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBEz Blog 1.0 - Cross-Site Scripting / Cross-Site Request Forgery Exploit-DBEz Cart 1.0 - Multiple Cross-Site Request Forgery Vulnerabilities TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a blog via the add_blog action, (2) approve a comment via the approve_comment action, (3) change administrator information including the password via the admin_opt action, and (4) delete a blog via the delete action.

Weaknesses (CWE)

CWE-352

Affected Products (1)

scriptsez · ez_blogvulnerable

References (8)

http://osvdb.org/61114

http://packetstormsecurity.org/0912-exploits/ezblog-xssxsrf.txt

Exploit

http://secunia.com/advisories/37743

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54895

http://osvdb.org/61114