CVE-2008-4725

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.9%

exploitation probability

4.9%top 9% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than CVE-2008-4696. NOTE: some of these issues were addressed before 9.60.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6801

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/32299 http://securityreason.com/securityalert/4504 https://exchange.xforce.ibmcloud.com/vulnerabilities/46003 https://exchange.xforce.ibmcloud.com/vulnerabilities/46231 https://www.exploit-db.com/exploits/6801 http://www.openwall.com/lists/oss-security/2008/10/21/6 http://www.openwall.com/lists/oss-security/2008/10/22/5 http://www.opera.com/docs/changelogs/freebsd/961/http://www.opera.com/docs/changelogs/linux/961/http://www.opera.com/docs/changelogs/mac/961/http://www.opera.com/docs/changelogs/solaris/961/http://www.opera.com/docs/changelogs/windows/961/