CVE-2009-2733

Published: Oct 16, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.

Affected (32)

Products: Achievo: Achievo

Achievo

1 product

Achievo

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Achievo Achievo	Up to 1.3.4
Achievo Achievo	Version 0.7.0
Achievo Achievo	Version 0.7.1
Achievo Achievo	Version 0.7.2
Achievo Achievo	Version 0.7.3
Achievo Achievo	Version 0.8.0
Achievo Achievo	Version 0.8.0_rc1
Achievo Achievo	Version 0.8.0_rc2
Achievo Achievo	Version 0.8.1
Achievo Achievo	Version 0.9.0
Achievo Achievo	Version 0.9.1
Achievo Achievo	Version 1.0.0
Achievo Achievo	Version 1.0.0 rc1
Achievo Achievo	Version 1.0.0 rc2
Achievo Achievo	Version 1.0.0 rc3
Achievo Achievo	Version 1.0.1
Achievo Achievo	Version 1.0.2
Achievo Achievo	Version 1.0.3
Achievo Achievo	Version 1.0.4
Achievo Achievo	Version 1.1.0
Achievo Achievo	Version 1.1.0 rc1
Achievo Achievo	Version 1.1.0 rc2
Achievo Achievo	Version 1.1.0 rc3
Achievo Achievo	Version 1.2.0
Achievo Achievo	Version 1.2.0 rc1
Achievo Achievo	Version 1.2.1
Achievo Achievo	Version 1.3.0
Achievo Achievo	Version 1.3.0 rc1
Achievo Achievo	Version 1.3.0 rc2
Achievo Achievo	Version 1.3.1
Achievo Achievo	Version 1.3.2
Achievo Achievo	Version 1.3.3