CVE-2009-4459

no score yetEPSS 1.1%

Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2009-12-30
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

redmine:redmine

References

http://www.exploit-db.com/exploits/10554
http://www.securityfocus.com/bid/37425
https://exchange.xforce.ibmcloud.com/vulnerabilities/54947
http://www.exploit-db.com/exploits/10554
http://www.securityfocus.com/bid/37425

Check your stack JSON