Skip to content

CVE-2011-0728

Loggerhead XSS via filename

3.5 LowFix available

CVE-2011-0728 is a low vulnerability (CVSS 3.5) in Michael Hudson-doyle Loggerhead, published March 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 78th percentile. Fixed in loggerhead 1.18.1.

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Exploit likelihood

1.83%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: CVE-2011-0728
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: CVE-2011-0728
Updated: 2026-11-02

EUVDEUVD-2022-4991 No score

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: EUVD-2022-4991
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qjmg-77xh-7mjw No score

Loggerhead XSS via filename

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: GHSA-qjmg-77xh-7mjw
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: CVE-2011-0728
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-0728 No score

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: DEBIAN-CVE-2011-0728
Updated: 2026-11-02

OSVGHSA-qjmg-77xh-7mjw No score

Loggerhead XSS via filename

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: GHSA-qjmg-77xh-7mjw
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2026-840 No score

Loggerhead XSS via filename

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Record: PYSEC-2026-840
Updated: 2026-11-02

Affected products

michael hudson-doyle loggerhead

Affected packages

Affected packages
Package	Affected	Fixed
`loggerhead` PyPI	before 1.18.1	1.18.1
`loggerhead` Debian:12	before 1.18.1-1	1.18.1-1
`loggerhead` Debian:13	before 1.18.1-1	1.18.1-1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less