CVE-2009-2641: Rich White School Data Nav

Medium severity, CVSS 6.8. EPSS: 1.7% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in app_and_readme/navigator/index.php in School Data Navigator allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.

Affected products

• Rich White School Data Nav: any version

Published 2009-07-28. Last modified 2026-06-16.