CVE-2009-3755: Multiple cross-site scripting (XSS) vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitra...

Security readout for executives and security teams

CVE-2009-3755 describes multiple cross-site scripting issues in phpBMS 0.96. An attacker could inject script or HTML through crafted PATH_INFO values, potentially affecting users who view the resulting pages. The sources do not provide CVSS, a vendor fix, or evidence of active exploitation. Exposure is likely limited to organizations still running phpBMS 0.96, especially internet-facing or broadly accessible internal instances. The structured affected-product data is incomplete, so asset confirmation is required. Treat as a targeted legacy-application risk. Prioritize action if phpBMS 0.96 remains accessible to users or the internet; otherwise track as part of legacy software removal. Mitigation focus: Identify and retire or isolate any phpBMS 0.96 deployments.; Check phpBMS or vendor guidance for fixed versions or migration instructions.; Restrict access to administrative and account pages until remediation is confirmed..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.