01 Record

CVE-2015-5667

Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a

UnratedPUBLISHEDCNA: jpcert

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 2.09% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 81.5% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2015-10-31 01:00Z11 YR AGO

Last updated

2024-08-06 06:59Z2 YR AGO

Reserved

2015-07-24

Assigning CNA

jpcert

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

13d0d67f1bb60526415906b2ef37d477ef52d8a25f00f3597a61d172785ae8ac

05 Affected products

VendorProductVersionsPlatforms

html-scrubber_projecthtml-scrubberNot specified—

06 References

metacpan.orghttps://metacpan.org/release/HTML-Scrubberx_refsource_CONFIRM
jvndb.jvn.jpJVNDB-2015-000171http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171third-party-advisoryx_refsource_JVNDB
lists.fedoraproject.orgFEDORA-2015-fed35dffd7http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172997.htmlvendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2015-95f5ff8d44http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172983.htmlvendor-advisoryx_refsource_FEDORA
jvn.jpJVN#53973084http://jvn.jp/en/jp/JVN53973084/index.htmlthird-party-advisoryx_refsource_JVN
lists.fedoraproject.orgFEDORA-2015-84a95e39d4http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172934.htmlvendor-advisoryx_refsource_FEDORA

07 Fixed in

Debian 12

libhtml-scrubber-perl
Fixed in 0.15-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

libhtml-scrubber-perl
Fixed in 0.15-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

libhtml-scrubber-perl
Fixed in 0.15-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 14.04 LTS

libhtml-scrubber-perl
Fixed in 0.11-1+deb8u1build0.14.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.