CVE-2009-2438: Cross-site scripting (XSS) vulnerability in index.php in the search module in ClanSphere 2009.0 and 2009.0....

Security readout for executives and security teams

CVE-2009-2438 is an old cross-site scripting issue in the ClanSphere search module. A remote attacker could cause the application to return attacker-controlled script or HTML through a search request. Business urgency depends on whether any legacy ClanSphere 2009.0 or 2009.0.2 instance is still reachable. Exposure is likely limited to organizations still running legacy ClanSphere 2009.0 or 2009.0.2, especially internet-facing instances with the search module enabled. Treat this as a legacy exposure cleanup item unless an affected public instance is found. If found, prioritize removal, upgrade, or isolation because XSS can compromise users of the application. Mitigation focus: Inventory and retire any unsupported ClanSphere 2009.0 or 2009.0.2 deployments.; Check ClanSphere or advisory guidance for a supported fixed version before patching.; If replacement is delayed, restrict public access to affected search functionality..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.