CVE-2009-0249

CVE-2009-0249 describes a critical information disclosure vulnerability in Katy Whitton RankEm, where sensitive data, including user credentials, is stored under the web root with inadequate access controls. This allows unauthenticated remote attackers to directly download the database/topsites.mdb file. The vulnerability has a CVSS score of 5.0, indicating a medium severity, and allows for complete confidentiality compromise with low attack complexity and no authentication required. While not listed on the KEV catalog or Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.