CVE-2009-3450

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-29 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allow remote attackers to inject arbitrary web script or HTML via parameters with names beginning with __ (underscore underscore) sequences, which are incompatible with an XSS protection mechanism provided by Microsoft ASP.NET.

Affected products

Radactive I-Load: through 2008.r2; 1.6.3, 1.6.3.1, 1.6.3.2, 1.6.3.3, 1.7.0.0, 1.7.0.1 (+40)

References

http://radnet.radactive.com/forum/Default.aspx?g=posts&t=339
http://secunia.com/advisories/23807
http://www.osvdb.org/58195
http://www.securityfocus.com/archive/1/506555/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/53348
https://www.sec-consult.com/files/20090917-0_RADactive_I-Load_Multiple_Vulnerabilities.txt
http://radnet.radactive.com/forum/Default.aspx?g=posts&t=339
http://secunia.com/advisories/23807
http://www.osvdb.org/58195
http://www.securityfocus.com/archive/1/506555/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/53348
https://www.sec-consult.com/files/20090917-0_RADactive_I-Load_Multiple_Vulnerabilities.txt

Get alerted when CVE-2009-3450 or the next vulnerability affects your stack