CVE-2009-4159: Ivan Kartolo Direct Mail

Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Affected products

• Ivan Kartolo Direct Mail: up to and including 2.6.4; version 2.0.0 only; version 2.0.1 only; version 2.1.1 only; version 2.1.2 only; version 2.1.4 only; …

Published 2009-12-02. Last modified 2026-06-16.