Unscored severity · published Jul 17, 2007
CVE-2007-3822
Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (1) the who parameter to showuser; and…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (1) the who parameter to showuser; and other vectors involving (2) calendar mode, (3) bulletin board mode, (4) room names, and (5) uploaded file names.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webcit · Citadel
through 7.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3822
osvdb.org
http://osvdb.org/38176
osvdb.org
http://osvdb.org/38177
osvdb.org
http://osvdb.org/38178
osvdb.org
http://osvdb.org/38179
osvdb.org
http://osvdb.org/38180
secunia.com
http://secunia.com/advisories/26090
More from Webcit
9.8
CVE-2020-27739
A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions
6.5
CVE-2020-27742
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move…
6.1
CVE-2020-27741
Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters
5.9
CVE-2020-29547
An issue was discovered in Citadel through webcit-926
5.3
CVE-2020-27740
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform