CVE-2009-1505

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-05-01 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.

Affected products

Drupal News Page: 5.x-1.1, 5.x-1.x

References

http://drupal.org/node/449014
http://osvdb.org/54151
http://secunia.com/advisories/34954
http://www.securityfocus.com/bid/34777
http://www.vupen.com/english/advisories/2009/1214
https://exchange.xforce.ibmcloud.com/vulnerabilities/50248
http://drupal.org/node/449014
http://osvdb.org/54151
http://secunia.com/advisories/34954
http://www.securityfocus.com/bid/34777
http://www.vupen.com/english/advisories/2009/1214
https://exchange.xforce.ibmcloud.com/vulnerabilities/50248

Get alerted when CVE-2009-1505 or the next vulnerability affects your stack