CVE-2008-2951

CVE-2008-2951 affects Trac before 0.10.5, where the search script’s q parameter enables an open redirect to arbitrary sites, potentially enabling phishing. The GHSA and OSV entries describe this as a Trac open redirect vulnerability. Exploitation would involve remote actors enticing a user to fol...

CVE-2010-5108

The provided connected documents confirm a concrete vulnerability: Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. The root cause is an improper permission check during workflow transitions, which could let an attacker change a ticket’s status and resolution wi...

CVE-2009-4405

Trac before 0.11.6 is affected by multiple unspecified vulnerabilities related to (1) policy checks in report results when using alternate formats and (2) a missing 'raw' role check in docutils