CVE-2009-2937

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-09-18 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed.

Affected products

Intertwingly Planet: 2.0
Intertwingly Planet Venus: all versions

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546178
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546179
http://intertwingly.net/blog/2009/09/09/Venus-Updates
http://lists.planetplanet.org/archives/devel/2009-September/001999.html
http://secunia.com/advisories/36636
http://secunia.com/advisories/36766
http://www.securityfocus.com/bid/36392
https://bugzilla.redhat.com/show_bug.cgi?id=522802
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00504.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00525.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546178
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546179

Get alerted when CVE-2009-2937 or the next vulnerability affects your stack