CVE-2009-2009: Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote att...

Security readout for executives and security teams

CVE-2009-2009 is a set of cross-site scripting issues in Dokeos 1.8.5, possibly earlier. A remote attacker could inject script or HTML through specific document and exercise pages. Business risk depends on whether a legacy Dokeos portal is still exposed and used by authenticated learners, staff, or administrators. Exposure is most likely on internet-facing or intranet Dokeos e-learning installations running version 1.8.5 or possibly older. Organizations that retired Dokeos or upgraded away from this branch are less likely to be affected. Prioritize this if Dokeos 1.8.5 or older remains exposed. The issue is old and lacks provided severity scoring, but legacy web applications with XSS can create account, data, and trust risks, especially for administrator sessions. Mitigation focus: Inventory Dokeos instances and confirm exact deployed versions.; Check Dokeos vendor security guidance for fixed versions or patches.; Restrict access to legacy Dokeos portals until status is confirmed..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.