{"api_version":"1","generated_at":"2026-07-23T09:41:27+00:00","cve":"CVE-2009-3961","urls":{"html":"https://cve.report/CVE-2009-3961","api":"https://cve.report/api/cve/CVE-2009-3961.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-3961","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-3961"},"summary":{"title":"CVE-2009-3961","description":"SQL injection vulnerability in user.php in Super Serious Stats (aka superseriousstats) before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an \"incorrect regexp.\" NOTE: some of these details are obtained from third party information.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-11-17 18:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/37316","name":"http://secunia.com/advisories/37316","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Super Serious Stats \"uid\" SQL Injection Vulnerability - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://code.google.com/p/superseriousstats/","name":"http://code.google.com/p/superseriousstats/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"superseriousstats -\n \n Project Hosting on Google Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2009/3175","name":"http://www.vupen.com/english/advisories/2009/3175","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3961","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3961","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"1.0.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"1.0.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"1.0.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"1.0.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"1.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"1.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3961","vulnerable":"1","versionEndIncluding":"1.1.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jos_de_ruijter","cpe5":"superseriousstats","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:45:50.785Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"ADV-2009-3175","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/3175"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://code.google.com/p/superseriousstats/"},{"name":"37316","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/37316"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-11-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in user.php in Super Serious Stats (aka superseriousstats) before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an \"incorrect regexp.\" NOTE: some of these details are obtained from third party information."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2009-11-24T10:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"ADV-2009-3175","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/3175"},{"tags":["x_refsource_CONFIRM"],"url":"http://code.google.com/p/superseriousstats/"},{"name":"37316","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/37316"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-3961","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in user.php in Super Serious Stats (aka superseriousstats) before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an \"incorrect regexp.\" NOTE: some of these details are obtained from third party information."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ADV-2009-3175","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/3175"},{"name":"http://code.google.com/p/superseriousstats/","refsource":"CONFIRM","url":"http://code.google.com/p/superseriousstats/"},{"name":"37316","refsource":"SECUNIA","url":"http://secunia.com/advisories/37316"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-3961","datePublished":"2009-11-17T18:00:00.000Z","dateReserved":"2009-11-17T00:00:00.000Z","dateUpdated":"2024-08-07T06:45:50.785Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-11-17 18:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.2","matchCriteriaId":"E67DC620-75B6-4432-871D-312885277899"},{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:1.0.13:*:*:*:*:*:*:*","matchCriteriaId":"32A6FFBE-936F-497E-A057-964937F0A8BF"},{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:1.0.14:*:*:*:*:*:*:*","matchCriteriaId":"D1FB0BA3-7D35-430B-AC9C-82A6770C7AAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:1.0.15:*:*:*:*:*:*:*","matchCriteriaId":"0BADEA01-DA2C-4E6F-81BF-0C5D861AE6E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:1.0.16:*:*:*:*:*:*:*","matchCriteriaId":"8718D0DA-9803-4265-8848-54A00055E671"},{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:1.1.0:*:*:*:*:*:*:*","matchCriteriaId":"1D07DAB5-39E0-4758-BD42-7DB4C71D8DC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:jos_de_ruijter:superseriousstats:1.1.1:*:*:*:*:*:*:*","matchCriteriaId":"E23D3D44-6423-4C3E-8E96-932786D4A610"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"3961","Ordinal":"1","Title":"CVE-2009-3961","CVE":"CVE-2009-3961","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"3961","Ordinal":"1","NoteData":"SQL injection vulnerability in user.php in Super Serious Stats (aka superseriousstats) before 1.1.2p1 allows remote attackers to execute arbitrary SQL commands via the uid parameter, related to an \"incorrect regexp.\" NOTE: some of these details are obtained from third party information.","Type":"Description","Title":"CVE-2009-3961"},{"CveYear":"2009","CveId":"3961","Ordinal":"2","NoteData":"2009-11-17","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"3961","Ordinal":"3","NoteData":"2009-11-24","Type":"Other","Title":"Modified"}]}}}