{"cve":"CVE-2009-2929","nvd":{"published":"2009-08-21T20:30:00.343","modified":"2026-06-16T23:10:31.377","status":"Modified","description":"Multiple SQL injection vulnerabilities in TGS Content Management 0.x allow remote attackers to execute arbitrary SQL commands via the (1) tgs_language_id, (2) tpl_dir, (3) referer, (4) user-agent, (5) site, (6) option, (7) db_optimization, (8) owner, (9) admin_email, (10) default_language, and (11) db_host parameters to cms/index.php; and the (12) cmd, (13) s_dir, (14) minutes, (15) s_mask, (16) test3_mp, (17) test15_file1, (18) submit, (19) brute_method, (20) ftp_server_port, (21) userfile14, (22) subj, (23) mysql_l, (24) action, and (25) userfile1 parameters to cms/frontpage_ception.php. NOTE: some of these parameters may be applicable only in nonstandard versions of the product, and cms/frontpage_ception.php may be cms/frontpage_caption.php in all released versions.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-89"],"references":["http://www.exploit-db.com/exploits/9434","https://exchange.xforce.ibmcloud.com/vulnerabilities/52468","http://www.exploit-db.com/exploits/9434","https://exchange.xforce.ibmcloud.com/vulnerabilities/52468"],"products":["tgs-cms:tgs_content_management"],"source":"nvd","synced_at":"2026-10-19T19:54:26.868835795+00:00"},"epss":{"cve":"CVE-2009-2929","score":0.00952,"percentile":0.61324,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}