CVE-2009-4477

The CVE-2009-4477 entry corresponds to a SQL injection in page.html of Xstate Real Estate 1.0, exploitable via the pid parameter. The vulnerability is network-accessible, with low attack complexity and no authentication required, leading to partial confidentiality, integrity, and availability imp...

CVE-2009-4478

CVE-2009-4478 affects Xstate Real Estate 1.0 with multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via PATH_INFO to (1) home.html or (2) lands.html. The vulnerability stems from improper PATH_INFO handling. Impact is web-based XSS; no specific exploi...