Read the docs
TI-2009-02332 Aliases CVE-2009-2444GHSA-c794-94g7-5hfq

Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender…

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and 2.0 before RC2, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter to setup/index.php.

Why it matters now

EPSS 0.01917 79th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:adbnewssender:adbnewssender:*:*:*:*:*:*:*:*up to 1.5.5VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.0:*:*:*:*:*:*:*1.0VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.1:*:*:*:*:*:*:*1.1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableAdbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:*:*:*:*:*:*:*:* Versions up to 1.5.5 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Adbnewssender
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adbnewssender:adbnewssender:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.9:*:*:*:*:*:*:*1.4.9VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.10:*:*:*:*:*:*:*1.4.10VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.4.11:*:*:*:*:*:*:*1.4.11VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha1:*:*:*:*:*:*2.0 alpha1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha2:*:*:*:*:*:*2.0 alpha2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha3:*:*:*:*:*:*2.0 alpha3VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha4:*:*:*:*:*:*2.0 alpha4VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:beta1:*:*:*:*:*:*2.0 beta1VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:beta2:*:*:*:*:*:*2.0 beta2VulnerableAdbnewssender
cpe:2.3:a:adbnewssender:adbnewssender:2.0:rc1:*:*:*:*:*:*2.0 rc1VulnerableAdbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.8:*:*:*:*:*:*:* Versions 1.4.8 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.9:*:*:*:*:*:*:* Versions 1.4.9 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.4.11:*:*:*:*:*:*:* Versions 1.4.11 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha1:*:*:*:*:*:* Versions 2.0 alpha1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha2:*:*:*:*:*:* Versions 2.0 alpha2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha3:*:*:*:*:*:* Versions 2.0 alpha3 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:alpha4:*:*:*:*:*:* Versions 2.0 alpha4 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:beta1:*:*:*:*:*:* Versions 2.0 beta1 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:beta2:*:*:*:*:*:* Versions 2.0 beta2 Vulnerable ·Adbnewssender
  • cpe:2.3:a:adbnewssender:adbnewssender:2.0:rc1:*:*:*:*:*:* Versions 2.0 rc1 Vulnerable ·Adbnewssender

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2444
  2. 2026-10-03 Alias added: GHSA-c794-94g7-5hfq

References

Exploit 2

Patch 2

  • TI-2009-02337 Directory traversal vulnerability in maillinglist/admin/change_config.php in… CVSS 2.0HIGH 7.5
  • TI-2008-05743 Cross-site scripting (XSS) vulnerability in ADbNewsSender before 1.5.2 allows remote… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences