CVE-2007-3001

Multiple cross-site scripting (XSS) vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to inject arbitrary web script or HTML via (1) the sUName parameter to UserArea/Authenticate.php, (2) the sAccountUnq parameter to UserArea/NewAccounts/index.php, or the (3) iCategoryUnq, (4) iDBLoc, (5) iTtlNumItems, (6) iNumPerPage, or (7) sSort parameter to G_Display.php, different vectors than CVE-2005-4239.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.90% chance of exploitation in the next 30 days, 78th percentile

Published

2007-06-04

Updated

2024-08-07

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/30116
• https://www.exploit-db.com/exploits/30115
• https://www.exploit-db.com/exploits/30114

References

• CVE Record
• NVD entry

Related

• CVE-2007-3000
• CVE-2007-3003
• CVE-2007-2991
• CVE-2007-3006
• CVE-2007-2988
• CVE-2007-3009