Read the docs
TI-2009-02040 Aliases CVE-2009-2133GHSA-3xrq-pc9j-cp42

Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow…

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrary web script or HTML via the (1) menu or (2) sort parameter to pivot/index.php, (3) the value of a check array parameter in a delete action to pivot/index.php, (4) the element name in a check array parameter in a delete action to pivot/index.php, (5) the edituser parameter in an edituser action to pivot/index.php, (6) the edit parameter in a templates action to pivot/index.php, (7) the blog parameter in a blog_edit1 action to pivot/index.php, (8) the cat parameter in a cat_edit action to pivot/index.php, (9) a certain form field in a doaction=1 request to pivot/index.php, (10) the url field in a my_weblog edit_prefs action to pivot/user.php, or (11) the username (aka name) field in a my_weblog reg_user action to pivot/user.php.

Why it matters now

EPSS 0.04089 90th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pivot:pivot:1.40.4:*:*:*:*:*:*:*1.40.4VulnerablePivot
cpe:2.3:a:pivot:pivot:1.40.7:*:*:*:*:*:*:*1.40.7VulnerablePivot
  • cpe:2.3:a:pivot:pivot:1.40.4:*:*:*:*:*:*:* Versions 1.40.4 Vulnerable ·Pivot
  • cpe:2.3:a:pivot:pivot:1.40.7:*:*:*:*:*:*:* Versions 1.40.7 Vulnerable ·Pivot

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2133
  2. 2026-10-03 Alias added: GHSA-3xrq-pc9j-cp42

References

Exploit 2

Other 2

  • TI-2006-03423 includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication… CVSS 2.0HIGH 7.5
  • TI-2006-03425 Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when… CVSS 2.0MEDIUM 5.8
  • TI-2006-03424 PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier… CVSS 2.0MEDIUM 5.1
  • TI-2008-02991 Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers… CVSS 2.0MEDIUM 5.0
  • TI-2009-02041 pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences