CVE-2009-4647

VendoraccellionProductsecure file transfer applianceDiscoveredFeb 19, 2010UpdatedApr 29, 2026

Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs.

View graph Watch Export

CVSS v3.1

—

EPSS

1.07%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

Connections

2 relationships

CWE-79

source

Timeline

disclosure → media coverage

Feb 19, 2010

Disclosure — published as a CVE record. · last revised by NVD Apr 29, 2026