CVE-2009-2168
CRITICAL · CVSS 9.8EPSS 11.8%EU EUVD
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.
Key facts
- CVSS score
- 9.8 (v3.1)
- Severity
- CRITICAL
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-287
- EPSS score
- 11.8% (96th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-2164)
- Published
- June 22, 2009
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-2164 in the EU Vulnerability Database. Last updated in EUVD on January 21, 2025.
View on the EU Vulnerability DatabaseAffected products
- egyplus / 7ammel
References
- https://www.exploit-db.com/exploits/8865(Exploit, Third Party Advisory, VDB Entry)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain