CVE-2008-4725
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to...
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.
- Record
CVE-2008-4725- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.
- Record
CVE-2008-4725- Updated
- 2026-11-02
EUVDEUVD-2008-4705 No score
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.
- Record
EUVD-2008-4705- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hrm3-68f9-5g6j No score
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to...
Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.
- Record
GHSA-hrm3-68f9-5g6j- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Opera 9.60 - Persistent Cross-Site Scripting | 2008-10-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-4725 is a medium vulnerability (CVSS 4.3) in Opera Browser, published October 23, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.89%, the 92nd percentile. No source names a fixed version.
References
vupen.com/english/advisories/2008/2873
openwall.com/lists/oss-security/2008/10/21/6
opera.com/docs/changelogs/freebsd/961
secunia.com/advisories/32299
security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf
Show 13 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/46231
securityfocus.com/bid/31869
exploit-db.com/exploits/6801
securityreason.com/securityalert/4504
nvd.nist.gov/vuln/detail/CVE-2008-4725
github.com/advisories/GHSA-hrm3-68f9-5g6j