CVE-2009-3580: SQL-Ledger

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login, new_password, and confirm_password parameters in a preferences action.

Affected products

• SQL-Ledger SQL-Ledger: version 2.8.24 only

Published 2009-12-23. Last modified 2026-06-16.