CVE-2010-0726

tDiary <2.2.2 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.

References (7)

[Third Party Advisory] http://jvn.jp/en/jp/JVN73331060/index.html

[Third Party Advisory] http://jvndb.jvn.jp/jvndb/JVNDB-2010-000005

[Vendor Advisory] http://secunia.com/advisories/38742

[Product] http://tdiary.svn.sourceforge.net/viewvc/tdiary/branches/Stable-2_2/plugin/tb-send.rb?r1=3238&r2=3573

[Patch] http://www.securityfocus.com/bid/38413

[Patch, Vendor Advisory] http://www.tdiary.org/20100225.html

[Third Party Advisory, VDB Entry] http://osvdb.org/62562

Scores

EPSS 0.0052

EPSS Percentile 66.5%

Classification

CWE

CWE-79

Status published

Affected Products (7)

tdiary/tdiary < 2.2.2

tdiary/tdiary

tdiary/tdiary

tdiary/tdiary

tdiary/tdiary

tdiary/tdiary

n/a/n/a

Timeline

Published Mar 02, 2010

Tracked Since Feb 18, 2026