CVE-2008-4696

Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the History Search database (aka md.dat).

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html
• http://secunia.com/advisories/32299Vendor Advisory
• http://secunia.com/advisories/32394
• http://secunia.com/advisories/32538
• http://security.gentoo.org/glsa/glsa-200811-01.xml
• http://securityreason.com/securityalert/4504
• http://www.openwall.com/lists/oss-security/2008/10/21/6
• http://www.openwall.com/lists/oss-security/2008/10/22/5
• http://www.opera.com/docs/changelogs/freebsd/961/Patch
• http://www.opera.com/docs/changelogs/linux/961/Patch
• http://www.opera.com/docs/changelogs/mac/961/Patch
• http://www.opera.com/docs/changelogs/solaris/961/
• http://www.opera.com/docs/changelogs/windows/961/
• http://www.opera.com/support/search/view/903/Vendor Advisory
• http://www.security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf
• http://www.securityfocus.com/archive/1/497646/100/0/threaded
• http://www.securityfocus.com/bid/31869Exploit, Patch
• http://www.vupen.com/english/advisories/2008/2873
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46003
• https://www.exploit-db.com/exploits/6801
• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html
• http://secunia.com/advisories/32299Vendor Advisory
• http://secunia.com/advisories/32394
• http://secunia.com/advisories/32538
• http://security.gentoo.org/glsa/glsa-200811-01.xml
• http://securityreason.com/securityalert/4504
• http://www.openwall.com/lists/oss-security/2008/10/21/6
• http://www.openwall.com/lists/oss-security/2008/10/22/5
• http://www.opera.com/docs/changelogs/freebsd/961/Patch
• http://www.opera.com/docs/changelogs/linux/961/Patch
• http://www.opera.com/docs/changelogs/mac/961/Patch
• http://www.opera.com/docs/changelogs/solaris/961/
• http://www.opera.com/docs/changelogs/windows/961/
• http://www.opera.com/support/search/view/903/Vendor Advisory
• http://www.security-assessment.com/files/advisories/2008-10-22_Opera_Stored_Cross_Site_Scripting.pdf
• http://www.securityfocus.com/archive/1/497646/100/0/threaded
• http://www.securityfocus.com/bid/31869Exploit, Patch
• http://www.vupen.com/english/advisories/2008/2873
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46003
• https://www.exploit-db.com/exploits/6801

Published

Oct 23, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4690lynx 2.8.6dev.15 and earlier, when advanced mode is enabled …
• CVE-2008-4691Unspecified vulnerability in the SQLNLS_UNPADDEDCHARLEN func…
• CVE-2008-4692The Native Managed Provider for .NET component in IBM DB2 8 …
• CVE-2008-4693The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 a…
• CVE-2008-4694Unspecified vulnerability in Opera before 9.60 allows remote…
• CVE-2008-4695Opera before 9.60 allows remote attackers to obtain sensitiv…
• CVE-2008-4697The Fast Forward feature in Opera before 9.61, when a page i…
• CVE-2008-4698Opera before 9.61 does not properly block scripts during pre…
• CVE-2008-4699Insecure method vulnerability in the ActiveX control (PAWWeb…
• CVE-2008-4700SQL injection vulnerability in admin.php in Libera CMS 1.12 …
• CVE-2008-4701SQL injection vulnerability in admin.php in Libera CMS 1.12,…
• CVE-2008-4702Multiple directory traversal vulnerabilities in PhpWebGaller…