CVE-2005-4644

Trac HTML WikiProcessor cross-site scripting (XSS) vulnerability

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.

Exploit likelihood

1.52%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2005-4644
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-4644
Updated: 2026-11-02

EUVDEUVD-2005-0001 No score

Record: EUVD-2005-0001
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6vhp-hp77-6w52 5.3

Trac HTML WikiProcessor cross-site scripting (XSS) vulnerability

Record: GHSA-6vhp-hp77-6w52
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-6vhp-hp77-6w52 5.3

Trac HTML WikiProcessor cross-site scripting (XSS) vulnerability

Record: GHSA-6vhp-hp77-6w52
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2005-4644
Updated: 2026-11-02

OSVDEBIAN-CVE-2005-4644 No score

Record: DEBIAN-CVE-2005-4644
Updated: 2026-11-02

OSVPYSEC-2005-1 No score

Record: PYSEC-2005-1
Updated: 2026-11-02

Affected products

edgewall software trac

Affected packages

Affected packages
Package	Affected	Fixed
`trac` PyPI	before 0.9-stable	0.9-stable
`trac` Debian:13	before 0.9.3-1	0.9.3-1
`trac` Debian:14	before 0.9.3-1	0.9.3-1
`trac` Debian:3.1 From an advisory covering 2 CVEs	before 0.8.1-3sarge4, plus listed versions 0.8.1-30.8.1-3sarge10.8.1-3sarge20.8.1-3sarge3	0.8.1-3sarge4
`trac` PyPI	before 0.10, plus listed versions 0.8.40.9	0.10

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-4644 is a medium vulnerability (CVSS 4.3) in Edgewall Software Trac, published December 31, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in trac 0.9-stable.

References

Show 9 moreShow less