CVE:CVE-2011-2672
CNNVD:CNNVD-201109-258
SemanticScuttle是一个社会书签工具(基于Scuttle)的新功能，支持分级标签, 协作描述或openid认证。
SemanticScuttle 0.98之前版本中存在跨站脚本攻击漏洞。由于借助bookmarks.php中的address参数传递的输入在使用之前没有经过正确过滤，远程攻击者可利用该漏洞注入任意HTML和脚本代码，当浏览恶意数据时，这些代码会在受影响站点上下文的用户浏览器会话中得到执行。
solution:Upgrade christian_weiske semanticscuttle to a higher version than 0.97,0.85,0.86,0.87,0.88,0.89,0.90,0.91,0.92,0.93,0.94,0.95,0.96,and avoid the version (,0.97],0.85,0.86,0.87,0.88,0.89,0.90,0.91,0.92,0.93,0.94,0.95,0.96