Vulnerability Database

308,379

Total vulnerabilities in the database

CVE-2009-2733

Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.

  • Published: Oct 16, 2009
  • Updated: Nov 9, 2025
  • CVE: CVE-2009-2733
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
achievo / achievo 1.2.0 1.2.0.x
achievo / achievo 1.0.1 1.0.1.x
achievo / achievo 1.3.2 1.3.2.x
achievo / achievo 1.3.1 1.3.1.x
achievo / achievo 1.1.0-rc3 1.1.0-rc3.x
achievo / achievo 0.7.1 0.7.1.x
achievo / achievo 0.8.0_rc1 0.8.0_rc1.x
achievo / achievo 0.8.0 0.8.0.x
achievo / achievo 0.8.1 0.8.1.x
achievo / achievo 1.0.0 1.0.0.x
achievo / achievo 1.3.3 1.3.3.x
achievo / achievo 1.2.1 1.2.1.x
achievo / achievo 1.2.0-rc1 1.2.0-rc1.x
achievo / achievo 0.8.0_rc2 0.8.0_rc2.x
achievo / achievo 1.0.2 1.0.2.x
achievo / achievo 1.3.0-rc1 1.3.0-rc1.x
achievo / achievo 0.7.2 0.7.2.x
achievo / achievo 1.0.0-rc3 1.0.0-rc3.x
achievo / achievo 1.1.0-rc2 1.1.0-rc2.x
achievo / achievo 0.9.1 0.9.1.x
achievo / achievo 1.0.3 1.0.3.x
achievo / achievo 1.0.4 1.0.4.x
achievo / achievo 1.0.0-rc2 1.0.0-rc2.x
achievo / achievo - 1.3.4.x
achievo / achievo 0.7.3 0.7.3.x
achievo / achievo 1.1.0-rc1 1.1.0-rc1.x
achievo / achievo 1.3.0 1.3.0.x
achievo / achievo 1.1.0 1.1.0.x
achievo / achievo 0.9.0 0.9.0.x
achievo / achievo 0.7.0 0.7.0.x
achievo / achievo 1.3.0-rc2 1.3.0-rc2.x
achievo / achievo 1.0.0-rc1 1.0.0-rc1.x