{"id":"CVE-2011-0728","aliases":["GHSA-qjmg-77xh-7mjw","PYSEC-2026-840"],"title":"Loggerhead XSS via filename","summary":"Loggerhead XSS via filename","severity":"low","vendor":"loggerhead","product":"loggerhead","ecosystem":"pip","affected":["loggerhead < 1.18.1"],"patched":["loggerhead 1.18.1"],"published":"2022-05-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qjmg-77xh-7mjw","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0728"},{"url":"https://bugs.launchpad.net/loggerhead/+bug/740142"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66305"},{"url":"https://launchpad.net/loggerhead/1.18/1.18.1"},{"url":"https://web.archive.org/web/20200228162139/http://www.securityfocus.com/bid/47032"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057413.html"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057479.html"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057502.html"}],"tags":["osv","pip"],"epss":0.01829,"epssPercentile":0.77576,"ingestedAt":"2026-07-08T18:25:52.450Z","slug":"CVE-2011-0728","body":"## Overview\n\nCross-site scripting (XSS) vulnerability in `templatefunctions.py` in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.\n\n## Affected packages\n\n- `loggerhead < 1.18.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `loggerhead 1.18.1`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}