CVE-2009-4834: Xpressengine Zeroboard

Medium severity, CVSS 6.8. EPSS: 4% chance of exploitation in the next 30 days.

lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibly related to now_connect.php.

Affected products

• Xpressengine Zeroboard: version 4.1 only

Published 2010-05-04. Last modified 2026-06-16.