CVE-2007-1405
Trac Cross-site Scripting (XSS) vulnerability
CVE-2007-1405 is a medium vulnerability (CVSS 4.3) in Edgewall Software Trac, published March 10, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 66th percentile. Fixed in trac 0.10.3.1.
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
CVE-2007-1405- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
CVE-2007-1405- Updated
- 2026-11-02
EUVDEUVD-2007-0003 No score
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
EUVD-2007-0003- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w7x2-57f7-3p3x
Trac Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
GHSA-w7x2-57f7-3p3x- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-w7x2-57f7-3p3x
Trac Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
GHSA-w7x2-57f7-3p3x- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
CVE-2007-1405- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1405 No score
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
DEBIAN-CVE-2007-1405- Updated
- 2026-11-02
OSVPYSEC-2007-2 No score
Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Record
PYSEC-2007-2- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/24470
exchange.xforce.ibmcloud.com/vulnerabilities/32897
vupen.com/english/advisories/2007/0900
securityfocus.com/bid/22888
trac.edgewall.org/wiki/ChangeLog
nvd.nist.gov/vuln/detail/CVE-2007-1405
Show 5 moreShow less
web.archive.org/web/20080801205940/http://secunia.com/advisories/24470
github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2007-2.yaml
security-tracker.debian.org/tracker/CVE-2007-1405