CVE-2009-2168

critical · 9.8

cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.

9.8

CVSS

11.8%

EPSS (exploit prob.)

96th

EPSS percentile

2009-06-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
egyplus	7ammel	<= 1.0.1

Check a specific version with /api/v1/cve/match.

References

https://www.exploit-db.com/exploits/8865
https://www.exploit-db.com/exploits/8865

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-2168