CVE-2009-1508: Keir Davis X-Forum

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

SQL injection vulnerability in the xforum_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL commands, as demonstrated via the cookie_username parameter to Configure.php.

Affected products

• Keir Davis X-Forum: version 0.6.2 only

Published 2009-05-01. Last modified 2026-06-16.