{"api_version":"1","generated_at":"2026-07-23T10:03:29+00:00","cve":"CVE-2009-5142","urls":{"html":"https://cve.report/CVE-2009-5142","api":"https://cve.report/api/cve/CVE-2009-5142.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-5142","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-5142"},"summary":{"title":"CVE-2009-5142","description":"Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-08-21 23:55:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://code.google.com/p/timthumb/issues/detail?id=49","name":"https://code.google.com/p/timthumb/issues/detail?id=49","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Issue 49 - \n timthumb -\n \n Cross-site Script Vulnerability - can inject javascript into URI - \n image crop zoom resize management - Google Project Hosting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html","name":"http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"WordPress Gamespeed Theme Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/71878","name":"http://www.osvdb.org/71878","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://code.google.com/p/timthumb/source/detail?r=65","name":"https://code.google.com/p/timthumb/source/detail?r=65","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Google Code Archive - Long-term storage for Google Code Project Hosting.","mime":"text/html","httpstatus":"500","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-5142","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-5142","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"5142","vulnerable":"1","versionEndIncluding":"1.09","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"binarymoon","cpe5":"timthumb","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"5142","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"prothemedesign","cpe5":"mimbo_pro","cpe6":"2.3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:32:23.257Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html"},{"name":"71878","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/71878"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://code.google.com/p/timthumb/issues/detail?id=49"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://code.google.com/p/timthumb/source/detail?r=65"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-08-21T23:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html"},{"name":"71878","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/71878"},{"tags":["x_refsource_CONFIRM"],"url":"https://code.google.com/p/timthumb/issues/detail?id=49"},{"tags":["x_refsource_CONFIRM"],"url":"https://code.google.com/p/timthumb/source/detail?r=65"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-5142","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/127724/WordPress-Gamespeed-Theme-Cross-Site-Scripting.html"},{"name":"71878","refsource":"OSVDB","url":"http://www.osvdb.org/71878"},{"name":"https://code.google.com/p/timthumb/issues/detail?id=49","refsource":"CONFIRM","url":"https://code.google.com/p/timthumb/issues/detail?id=49"},{"name":"https://code.google.com/p/timthumb/source/detail?r=65","refsource":"CONFIRM","url":"https://code.google.com/p/timthumb/source/detail?r=65"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-5142","datePublished":"2014-08-21T23:00:00.000Z","dateReserved":"2014-08-21T00:00:00.000Z","dateUpdated":"2024-09-16T23:22:04.799Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-08-21 23:55:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:binarymoon:timthumb:*:*:*:*:*:*:*:*","versionEndIncluding":"1.09","matchCriteriaId":"763AFF79-F868-46AB-B255-C7CBE46B8058"},{"vulnerable":true,"criteria":"cpe:2.3:a:prothemedesign:mimbo_pro:2.3.1:*:*:*:*:*:*:*","matchCriteriaId":"38106116-E262-4A02-AF24-915693F61277"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"5142","Ordinal":"1","Title":"CVE-2009-5142","CVE":"CVE-2009-5142","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"5142","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.","Type":"Description","Title":"CVE-2009-5142"},{"CveYear":"2009","CveId":"5142","Ordinal":"2","NoteData":"2014-08-21","Type":"Other","Title":"Published"}]}}}