CVE-2009-3949: Vivaprograms Infinity Script

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackers to create administrative accounts via the name, password, and conf_password parameters.

Affected products

• Vivaprograms Infinity Script: up to and including 2.0.5; version 2.0.0 only

Published 2009-11-16. Last modified 2026-06-16.