Read the docs
TI-2009-04750 Aliases CVE-2009-4994GHSA-25fh-g53r-vqxf

Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack…

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

Why it matters now

EPSS 0.01022 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*up to 4.0.3483VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.0.3040:*:*:*:*:*:*:*3.0.3040VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.1.3050:*:*:*:*:*:*:*3.1.3050VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.1.3089:*:*:*:*:*:*:*3.1.3089VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.5.3126:*:*:*:*:*:*:*3.5.3126VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.5.3159:*:*:*:*:*:*:*3.5.3159VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.5.3167:*:*:*:*:*:*:*3.5.3167VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3216:*:*:*:*:*:*:*3.6.3216VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3217:*:*:*:*:*:*:*3.6.3217VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3229:*:*:*:*:*:*:*3.6.3229VulnerableSmarterTools
  • cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:* Versions up to 4.0.3483 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.0.3040:*:*:*:*:*:*:* Versions 3.0.3040 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.1.3050:*:*:*:*:*:*:* Versions 3.1.3050 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.1.3089:*:*:*:*:*:*:* Versions 3.1.3089 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.5.3126:*:*:*:*:*:*:* Versions 3.5.3126 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.5.3159:*:*:*:*:*:*:* Versions 3.5.3159 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.5.3167:*:*:*:*:*:*:* Versions 3.5.3167 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3216:*:*:*:*:*:*:* Versions 3.6.3216 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3217:*:*:*:*:*:*:* Versions 3.6.3217 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3229:*:*:*:*:*:*:* Versions 3.6.3229 Vulnerable ·SmarterTools
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartertrack:3.6.3246:*:*:*:*:*:*:*3.6.3246VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3267:*:*:*:*:*:*:*3.6.3267VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3274:*:*:*:*:*:*:*3.6.3274VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3309:*:*:*:*:*:*:*3.6.3309VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3355:*:*:*:*:*:*:*3.6.3355VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3411:*:*:*:*:*:*:*3.6.3411VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:3.6.3413:*:*:*:*:*:*:*3.6.3413VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:4.0.3387:*:*:*:*:*:*:*4.0.3387VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:4.0.3399:*:*:*:*:*:*:*4.0.3399VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:4.0.3411:*:*:*:*:*:*:*4.0.3411VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:4.0.3413:*:*:*:*:*:*:*4.0.3413VulnerableSmarterTools
cpe:2.3:a:smartertools:smartertrack:4.0.3435:*:*:*:*:*:*:*4.0.3435VulnerableSmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3246:*:*:*:*:*:*:* Versions 3.6.3246 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3267:*:*:*:*:*:*:* Versions 3.6.3267 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3274:*:*:*:*:*:*:* Versions 3.6.3274 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3309:*:*:*:*:*:*:* Versions 3.6.3309 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3355:*:*:*:*:*:*:* Versions 3.6.3355 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3411:*:*:*:*:*:*:* Versions 3.6.3411 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:3.6.3413:*:*:*:*:*:*:* Versions 3.6.3413 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:4.0.3387:*:*:*:*:*:*:* Versions 4.0.3387 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:4.0.3399:*:*:*:*:*:*:* Versions 4.0.3399 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:4.0.3411:*:*:*:*:*:*:* Versions 4.0.3411 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:4.0.3413:*:*:*:*:*:*:* Versions 4.0.3413 Vulnerable ·SmarterTools
  • cpe:2.3:a:smartertools:smartertrack:4.0.3435:*:*:*:*:*:*:* Versions 4.0.3435 Vulnerable ·SmarterTools

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4994
  2. 2026-10-03 Alias added: GHSA-25fh-g53r-vqxf

References

Patch 1

Other 1

  • TI-2020-19061 SmarterTools SmarterTrack 7922 -Information Disclosure CVSS 4.0MEDIUM 6.9
  • TI-2022-08260 Reflective XSS on SmarterTrack v100.0.8019.14010 CVSS 3.1HIGH 8.8
  • TI-2022-08263 File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010 CVSS 3.1CRITICAL 9.1
  • TI-2022-08262 Stored XSS in SmarterTrack v100.0.8019.14010 CVSS 3.1HIGH 8.8
  • TI-2022-08261 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010 CVSS 3.1MEDIUM 6.5
  • TI-2009-04751 Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences