CVE-2009-5065

Mark Pilgrim Feedparser < 4.1 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.

Exploits (1)

exploitdb WORKING POC VERIFIED

by fazalmajid · textremotemultiple

https://www.exploit-db.com/exploits/35570

View Code ZIP pw:eip

References (8)

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2011:082

[Vendor Advisory] http://support.novell.com/security/cve/CVE-2009-5065.html

[Exploit, Patch] http://code.google.com/p/feedparser/issues/detail?id=195

[Mailing List] http://lists.opensuse.org/opensuse-updates/2011-04/msg00026.html

[Vendor Advisory] http://secunia.com/advisories/44074

[Exploit, Patch] https://bugzilla.novell.com/show_bug.cgi?id=680074

[Exploit, Patch] https://bugzilla.redhat.com/show_bug.cgi?id=684877

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/47177

Scores

EPSS 0.0717

EPSS Percentile 91.5%

Classification

CWE

CWE-79

Status published

Affected Products (11)

mark_pilgrim/feedparser < 4.1

mark_pilgrim/feedparser

pypi/feedparser < 5.0PyPI

n/a/n/a

Timeline

Published Apr 11, 2011

Tracked Since Feb 18, 2026