Vulnerability Database

289,871

Total vulnerabilities in the database

CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.

  • Published: Jun 8, 2011
  • Updated: Apr 13, 2023
  • CVE: CVE-2009-5076
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
creloaded / cre_loaded 6.3 6.3.x
creloaded / cre_loaded 6.15 6.15.x
creloaded / cre_loaded - 6.2.x