CVE-2009-4159

Published: Dec 2, 2009Modified: Apr 23, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Affected (12)

Products: Ivan Kartolo: Direct Mail

Ivan Kartolo

1 product

Direct Mail

Configuration A

12 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ivan Kartolo Direct Mail	Up to 2.6.4
Ivan Kartolo Direct Mail	Version 2.0.0
Ivan Kartolo Direct Mail	Version 2.0.1
Ivan Kartolo Direct Mail	Version 2.1.1
Ivan Kartolo Direct Mail	Version 2.1.2
Ivan Kartolo Direct Mail	Version 2.1.4
Ivan Kartolo Direct Mail	Version 2.1.5
Ivan Kartolo Direct Mail	Version 2.5.0
Ivan Kartolo Direct Mail	Version 2.6.0
Ivan Kartolo Direct Mail	Version 2.6.1
Ivan Kartolo Direct Mail	Version 2.6.2
Ivan Kartolo Direct Mail	Version 2.6.3