CVE-2009-4573: Multiple cross-site scripting (XSS) vulnerabilities in the Joomulus (mod_joomulus) module 2.0 for Joomla!

Security readout for executives and security teams

This CVE describes reported cross-site scripting in the Joomulus module 2.0 for Joomla. If a vulnerable public site still serves the affected tag cloud Flash files, an attacker could inject script or HTML into a user’s browser. The record warns that the provenance is unknown and relies on third-party information. Exposure is most likely limited to legacy Joomla sites running Joomulus mod_joomulus 2.0 and serving the named SWF tag cloud files. The affected-product metadata is incomplete, so inventory confirmation is required. Treat this as a legacy exposure cleanup item unless inventory finds it on an internet-facing site. There is no sourced active exploitation evidence, but unsupported Joomla and Flash components increase operational risk. Mitigation focus: Check vendor or project guidance for any available fixed release or retirement notice.; Disable or remove Joomulus if it is unused or unsupported.; Restrict public access to affected SWF files where business use is not required..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.