Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

tDiary TrackBack plugin lets attackers run malicious code

CVE-2010-0726 · published 16 years ago
Summary

The TrackBack feature in tDiary versions up to 2.2.2 can be tricked into inserting harmful web scripts or HTML. This could let a remote attacker make a visitor’s browser execute unwanted actions, potentially stealing data or altering the displayed page. Update tDiary to a newer version or disable the TrackBack plugin until a fix is applied.

What to do
  • Update debian tdiary to version 2.2.1-1.1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian tdiary < 2.2.1-1.1
Fix: upgrade to 2.2.1-1.1
Debian:13 debian tdiary < 2.2.1-1.1
Fix: upgrade to 2.2.1-1.1
Debian:14 debian tdiary < 2.2.1-1.1
Fix: upgrade to 2.2.1-1.1
– tdiary tdiary <= 2.2.2
2.0.1
2.0.2
2.0.3
2.1.1
2.1.4.2006-11-15
cpe:2.3:a:tdiary:tdiary:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vec...
Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Mar 2010
Updated4 Nov 2026
First seen4 Sep 2026
Sources
DEBIAN-CVE-2010-0726 · OSV
CVE-2010-0726 · NVD
Track software like this
Free during beta