Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Trac Download Feature Vulnerable to Malicious Script Injection in IE

CVE-2007-1405 · published 19 years ago
Summary

Using Internet Explorer, hackers can inject malicious code into Trac wiki pages, potentially allowing them to steal sensitive information or take control of your system. This issue affects Trac versions before 0.10.3.1. To protect your system, update to version 0.10.3.1 or later.

What to do
  • Update edgewall software trac to version 0.10.3.1.
Affected software
Ecosystem VendorProductAffected versions
pip edgewall software trac < 0.10.3.1
Fix: upgrade to 0.10.3.1
– edgewall_software trac 0.10
0.10.1
0.10.2
0.10.3
cpe:2.3:a:edgewall_software:trac:0.10:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary w...
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Mar 2007
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-w7x2-57f7-3p3x · GHSA
CVE-2007-1405 · NVD
Track software like this
Free during beta