CVE-2008-3328
Trac Cross-site Scripting (XSS) vulnerability
CVE-2008-3328 is a medium vulnerability (CVSS 4.3) in Edgewall Software Trac, published July 27, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in trac 0.10.5.
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
CVE-2008-3328- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
CVE-2008-3328- Updated
- 2026-11-02
EUVDEUVD-2008-0012 No score
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
EUVD-2008-0012- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x6jf-c7wh-7m7w
Trac Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
GHSA-x6jf-c7wh-7m7w- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-x6jf-c7wh-7m7w
Trac Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
GHSA-x6jf-c7wh-7m7w- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
CVE-2008-3328- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3328 No score
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
DEBIAN-CVE-2008-3328- Updated
- 2026-11-02
OSVPYSEC-2008-5 No score
Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
PYSEC-2008-5- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
redhat.com/archives/fedora-package-announce/2008-July/msg01270.html
securityfocus.com/bid/30400
exchange.xforce.ibmcloud.com/vulnerabilities/44016
secunia.com/advisories/31231
Show 9 moreShow less
vupen.com/english/advisories/2008/2223/references
trac.edgewall.org/wiki/ChangeLog
nvd.nist.gov/vuln/detail/CVE-2008-3328
web.archive.org/web/20140802031359/http://secunia.com/advisories/31231
github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2008-5.yaml
security-tracker.debian.org/tracker/CVE-2008-3328