CVE-2010-3906

Gitweb < 1.7.3.3 - Cross-Site Scripting via f and fp Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3906. PoCs published by emgent.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier versions. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the 'f' and 'fp' parameters in the URL.

Description

Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED
by emgent · textwebappscgi
https://www.exploit-db.com/exploits/15744

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier versions. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the 'f' and 'fp' parameters in the URL.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Gitweb 1.7.3.3 and previous versions
No auth needed
Prerequisites: A vulnerable version of Gitweb · Ability to craft a malicious URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (15)

Core 15
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43457
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42645
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052518.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42731
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3323
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-1003.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0010
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42743
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/15744
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:256
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024905
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45439
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0464
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052782.html

Scores

EPSS 0.0561
EPSS Percentile 91.9%

Details

CWE
CWE-79
Status published
Products (50)
git/git 0.99.9j
git/git 0.99.9k
git/git 0.99.9l
git/git 0.99.9m
git/git 0.99.9n
git/git 1.0.0
git/git 1.0.0b
git/git 1.0.3
git/git 1.0.4
git/git 1.0.5
... and 40 more
Published Dec 17, 2010
Tracked Since Feb 18, 2026