Unscored severity · published Jul 11, 2007
CVE-2007-3708
Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2)…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2) malformed nested tag manipulations in an unspecified component, related to insufficient sanitization by the xss_clean function.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Codeigniter · Codeigniter
1.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3708
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3708
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064500.html
osvdb.org
http://osvdb.org/37907
secunia.com
http://secunia.com/advisories/25991
securityreason.com
http://securityreason.com/securityalert/2877
www.securityfocus.com
http://www.securityfocus.com/archive/1/473190/100/0/threaded
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/35350
More from Codeigniter
9.8
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
9.8
CVE-2023-32692
CodeIgniter is a PHP full-stack web framework
9.8
CVE-2022-46170
CodeIgniter is a PHP full-stack web framework
9.8
CVE-2022-40834
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have…
9.8
CVE-2022-40824
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have…