Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

RSSOwl can run malicious code from crafted feeds

CVE-2006-4760 · published 20 years ago
Summary

The RSSOwl feed reader can be tricked into executing unwanted web scripts or HTML when it processes a specially crafted news feed. This could let an attacker display fake content or steal information from users of the application. Update RSSOwl to the latest version or apply the provided patches to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
benjamin_pasero_and_tobias_eichert rssowl All versions
cpe:2.3:a:benjamin_pasero_and_tobias_eichert:rssowl:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in Benjamin Pasero and Tobias Eichert RSSOwl allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by cer...
Multiple cross-site scripting (XSS) vulnerabilities in Benjamin Pasero and Tobias Eichert RSSOwl allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published13 Sep 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-4760 · NVD
Track software like this
Free during beta