CVE-2009-1912: Webspell

Medium severity, CVSS 6.8. EPSS: 3.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php.

Affected products

• Webspell Webspell: up to and including 4.2.0e; version 4.0 only; version 4.0.2c only; version 4.1 only; version 4.01.00 only; version 4.1.1 only; …

Published 2009-06-04. Last modified 2026-06-16.