CVE-2009-1458: Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote...

Security readout for executives and security teams

This CVE describes cross-site scripting in razorCMS before version 0.4. An attacker could inject script or HTML through specific admin/index.php parameters, potentially causing malicious content to run in a victim’s browser. The public bundle does not provide CVSS, CWE, CPE, or active exploitation evidence. Exposure is limited to organizations still running razorCMS before 0.4, especially where admin/index.php is reachable. The bundle’s affected CPE data is incomplete, so asset confirmation must rely on product and version evidence rather than CPE matching. Treat this as a legacy web application risk. It is not supported by current exploitation evidence in the provided sources, but any internet-facing razorCMS before 0.4 should be upgraded, isolated, or retired because XSS can support credential theft and administrator session abuse. Mitigation focus: Upgrade razorCMS to version 0.4 or later if the deployment is still in use.; Check original vendor guidance and archived advisories for the fixed release details.; Restrict access to admin/index.php to trusted administrative networks or users..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.