CVE-2009-3337

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-24 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQL commands via an unspecified parameter associated with Meta keywords in a blog entry.

Affected products

serendipity freetag plugin: before 3.09 — fixed in 3.09

How to fix

Upgrade to a fixed version: serendipity freetag plugin 3.09. Check the vendor advisory for mitigations.

References

http://blog.s9y.org/archives/210-Security-update-for-Freetag-Plugin.html
http://secunia.com/advisories/36706
http://www.securityfocus.com/bid/36376
http://blog.s9y.org/archives/210-Security-update-for-Freetag-Plugin.html
http://secunia.com/advisories/36706
http://www.securityfocus.com/bid/36376

Get alerted when CVE-2009-3337 or the next vulnerability affects your stack