← Vulnerability feed

Vulnerability record · CVE-2009-4421 · published 24 December 2009

CVE-2009-4421: Alexander palmo simple php blog path traversal vulnerability

AAlexander Palmo · Simple Php Blog

Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the blog_language1 parameter.

6.5 CVSS 2.0 Medium EPSS 2.0% · top 20.1% CWE-22 · Path traversal
6.5CVSS 2.0 base score
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the blog_language1 parameter.

AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0398.html Exploit
http://www.securityfocus.com/archive/1/508546/100/0/threaded
http://www.securityfocus.com/bid/37434 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/54970
http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0398.html Exploit
http://www.securityfocus.com/archive/1/508546/100/0/threaded
http://www.securityfocus.com/bid/37434 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/54970

Track CVE-2009-4421 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2007-5071Alexander palmo simple php blog vulnerabilityIncomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execut…EPSS 3.0%7.5CVE-2006-1243Alexander palmo simple php blog vulnerabilityDirectory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitr…EPSS 9.7%7.5CVE-2005-2733Simple PHP Blog upload_img_cgi.php unrestricted file extension uploadupload_img_cgi.php in Simple PHP Blog (SPHPBlog) fails to properly restrict the file extensions of uploaded files. Because uploaded files are not val…EPSS 51%analysed5.0CVE-2005-2787Alexander palmo simple php blog vulnerabilitycomment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter.EPSS 5.6%5.0CVE-2005-2192Alexander palmo simple php blog vulnerabilitySimplePHPBlog 0.4.0 stores password hashes in config/password.txt with insufficient access control, which allows remote attackers to obtain passwords…EPSS 4.1%5.0CVE-2005-0214Alexander palmo simple php blog vulnerabilityDirectory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) i…EPSS 1.7%5.0CVE-2005-1137Alexander palmo simple php blog vulnerabilitySimple PHP Blog (sphpBlog) 0.4.0 allows remote attackers to obtain sensitive information via a direct request to sb_functions.php, which leaks the fu…EPSS 1.3%4.3CVE-2011-5029Alexander palmo simple php blog cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web scri…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2009-4421), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.