{"api_version":"1","generated_at":"2026-07-23T08:47:18+00:00","cve":"CVE-2005-3955","urls":{"html":"https://cve.report/CVE-2005-3955","api":"https://cve.report/api/cve/CVE-2005-3955.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-3955","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-3955"},"summary":{"title":"CVE-2005-3955","description":"Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2005-12-01 06:03:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/18665","name":"http://www.securityfocus.com/bid/18665","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Jaws Search Gadget Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securitytracker.com/id?1015264","name":"http://securitytracker.com/id?1015264","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - blogBuddies Input Validation Holes Let Remote Users Conduct Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/21113","name":"http://www.osvdb.org/21113","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/15555","name":"http://www.securityfocus.com/bid/15555","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BlogBuddies Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847","name":"http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"SourceForge.net: Detail: 1366743 - Patch for Cross-Site Scripting vulnerability in blogBuddies","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2015/May/35","name":"http://seclists.org/fulldisclosure/2015/May/35","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: Feed2JS v1.7 XSS (Cross-site Scripting) Web Security\tVulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/438434/100/0/threaded","name":"http://www.securityfocus.com/archive/1/438434/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/2546","name":"http://www.vupen.com/english/advisories/2006/2546","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"inode/x-empty","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/20842","name":"http://secunia.com/advisories/20842","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Secunia - Advisories - Jaws Cross-Site Scripting and SQL Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17741","name":"http://secunia.com/advisories/17741","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"blogBuddies Cross-Site Scripting Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://retrogod.altervista.org/JAWS_062_sql.html","name":"http://retrogod.altervista.org/JAWS_062_sql.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Error 404 :(","mime":"text/plain","httpstatus":"404","archivestatus":"200"},{"url":"http://www.osvdb.org/21112","name":"http://www.osvdb.org/21112","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27337","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27337","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.jaws-project.com/index.php?blog/show/29","name":"http://www.jaws-project.com/index.php?blog/show/29","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Jaws 0.6.3 released","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/21643","name":"http://www.osvdb.org/21643","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3955","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3955","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"3955","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"blogbuddies","cpe5":"blogbuddies","cpe6":"0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3955","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jaws","cpe5":"jaws","cpe6":"0.6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3955","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magpierss","cpe5":"magpierss","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T23:31:48.767Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://retrogod.altervista.org/JAWS_062_sql.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847"},{"name":"jaws-magpieslashbox-xss(27337)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27337"},{"name":"20842","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/20842"},{"name":"20150508 Feed2JS v1.7 XSS (Cross-site Scripting) Web Security Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2015/May/35"},{"name":"17741","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17741"},{"name":"1015264","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015264"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.jaws-project.com/index.php?blog/show/29"},{"name":"21113","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/21113"},{"name":"15555","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/15555"},{"name":"20060626 Jaws <= 0.6.2 'Search gadget' SQL injection","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/438434/100/0/threaded"},{"name":"21112","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/21112"},{"name":"ADV-2006-2546","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/2546"},{"name":"21643","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/21643"},{"name":"18665","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/18665"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-11-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-19T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://retrogod.altervista.org/JAWS_062_sql.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847"},{"name":"jaws-magpieslashbox-xss(27337)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27337"},{"name":"20842","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/20842"},{"name":"20150508 Feed2JS v1.7 XSS (Cross-site Scripting) Web Security Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2015/May/35"},{"name":"17741","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17741"},{"name":"1015264","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015264"},{"tags":["x_refsource_MISC"],"url":"http://www.jaws-project.com/index.php?blog/show/29"},{"name":"21113","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/21113"},{"name":"15555","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/15555"},{"name":"20060626 Jaws <= 0.6.2 'Search gadget' SQL injection","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/438434/100/0/threaded"},{"name":"21112","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/21112"},{"name":"ADV-2006-2546","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/2546"},{"name":"21643","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/21643"},{"name":"18665","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/18665"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2005-3955","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://retrogod.altervista.org/JAWS_062_sql.html","refsource":"MISC","url":"http://retrogod.altervista.org/JAWS_062_sql.html"},{"name":"http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847","refsource":"CONFIRM","url":"http://sourceforge.net/tracker/index.php?func=detail&aid=1366743&group_id=127552&atid=708847"},{"name":"jaws-magpieslashbox-xss(27337)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27337"},{"name":"20842","refsource":"SECUNIA","url":"http://secunia.com/advisories/20842"},{"name":"20150508 Feed2JS v1.7 XSS (Cross-site Scripting) Web Security Vulnerabilities","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2015/May/35"},{"name":"17741","refsource":"SECUNIA","url":"http://secunia.com/advisories/17741"},{"name":"1015264","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015264"},{"name":"http://www.jaws-project.com/index.php?blog/show/29","refsource":"MISC","url":"http://www.jaws-project.com/index.php?blog/show/29"},{"name":"21113","refsource":"OSVDB","url":"http://www.osvdb.org/21113"},{"name":"15555","refsource":"BID","url":"http://www.securityfocus.com/bid/15555"},{"name":"20060626 Jaws <= 0.6.2 'Search gadget' SQL injection","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/438434/100/0/threaded"},{"name":"21112","refsource":"OSVDB","url":"http://www.osvdb.org/21112"},{"name":"ADV-2006-2546","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/2546"},{"name":"21643","refsource":"OSVDB","url":"http://www.osvdb.org/21643"},{"name":"18665","refsource":"BID","url":"http://www.securityfocus.com/bid/18665"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2005-3955","datePublished":"2005-12-01T11:00:00.000Z","dateReserved":"2005-12-01T00:00:00.000Z","dateUpdated":"2024-08-07T23:31:48.767Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-12-01 06:03:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:blogbuddies:blogbuddies:0.3:*:*:*:*:*:*:*","matchCriteriaId":"3173AFBD-9259-4CF7-9812-C085C0D7F27F"},{"vulnerable":true,"criteria":"cpe:2.3:a:jaws:jaws:0.6.2:*:*:*:*:*:*:*","matchCriteriaId":"6C6D4750-A567-47D2-A250-574A4FF558DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:magpierss:magpierss:7.1:*:*:*:*:*:*:*","matchCriteriaId":"5B45ACA6-FB65-435B-A3EB-4948268125D0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"3955","Ordinal":"1","Title":"CVE-2005-3955","CVE":"CVE-2005-3955","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"3955","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php.","Type":"Description","Title":"CVE-2005-3955"},{"CveYear":"2005","CveId":"3955","Ordinal":"2","NoteData":"2005-12-01","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"3955","Ordinal":"3","NoteData":"2018-10-19","Type":"Other","Title":"Modified"}]}}}