CVE-2009-0964

7.5 highEPSS 1.9%

High (7.5) in xlinesoft phprunner. EPSS 1.9% chance of exploitation in the next 30 days.

UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. NOTE: this can be leveraged with a separate SQL injection vulnerability to obtain passwords remotely without authentication.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-312
Published: 2009-03-19
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

xlinesoft:phprunner

References

http://osvdb.org/52804
http://www.bugreport.ir/index_63.htm
http://www.securityfocus.com/archive/1/501894/100/0/threaded
http://www.vupen.com/english/advisories/2009/0750
https://exchange.xforce.ibmcloud.com/vulnerabilities/49279

Check your stack JSON