CVE-2005-4454

CVE-2005-4454 is a medium-severity vulnerability in Livejournal with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.

Frequently asked questions

What is CVE-2005-4454?
Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.
How severe is CVE-2005-4454?
CVE-2005-4454 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2005-4454 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2005-4454?
CVE-2005-4454 affects Livejournal. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2005-4454?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2005-4454 published?
CVE-2005-4454 was published on 2005-12-21 and last updated on 2026-06-16.

References

Affected products (1)

More vulnerabilities in Livejournal

All CVEs affecting Livejournal →