Unscored severity · published May 2, 2007
CVE-2007-2470
Multiple cross-site scripting (XSS) vulnerabilities in index.php in FileRun 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2)…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in FileRun 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) module, or (3) section parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Filerun · Filerun
through 1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2470
pridels0.blogspot.com
http://pridels0.blogspot.com/2007/05/filerun-vuln.html
Vendor Advisory
http://secunia.com/advisories/25075
www.securityfocus.com
http://www.securityfocus.com/bid/23752
www.vupen.com
http://www.vupen.com/english/advisories/2007/1627
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/34007
More from Filerun
9.8
CVE-2022-47532
FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users§ion=cpanel&page=list request
9.8
CVE-2017-14738
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module…
8.8
CVE-2026-73693
FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
8.8
CVE-2026-14863
FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection
7.2
CVE-2026-73699
FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()