CVE-2009-2380: Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remo...

Security readout for executives and security teams

CVE-2009-2380 is a cross-site scripting issue in 4images versions 1.7 through 1.7.7. A remote attacker could inject web script or HTML through handling related to a url variable. The business risk is highest where legacy public 4images galleries remain reachable and users or administrators interact with attacker-controlled links or content. Exposure is most likely in organizations still operating internet-facing 4images 1.7 through 1.7.7 installations. The bundle does not identify affected CPEs, hosting patterns, default configurations, or fixed versions, so asset discovery must confirm product and version directly. Treat this as a legacy web application risk. It is not shown as actively exploited, but exposed outdated gallery software can create user-session and trust risks. Prioritize discovery and remediation if 4images remains public-facing or used by administrators. Mitigation focus: Inventory public and internal sites for 4images 1.7 through 1.7.7.; Check vendor and advisory links for official upgrade or patch guidance.; Retire or isolate unsupported legacy 4images deployments if no supported fix exists..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.