$ cve CVE-2007-3001 JSON

CVE-2007-3001 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.9% (pctl 79)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to inject arbitrary web script or HTML via (1) the sUName parameter to UserArea/Authenticate.php, (2) the sAccountUnq parameter to UserArea/NewAccounts/index.php, or the (3) iCategoryUnq, (4) iDBLoc, (5) iTtlNumItems, (6) iNumPerPage, or (7) sSort parameter to G_Display.php, different vectors than CVE-2005-4239.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.9% — more likely to be exploited than 79% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-06-04
Last modified	2026-06-16

Affected (1)

Vendor	Product
php jackknife	php jackknife

Public exploits

Source	Title	Date
exploit-db	PHP JackKnife 2.21 - '/(PHPJK) UserArea/Authenticate.php?sUName' Cross-Site Scripting	2007-05-31
exploit-db	PHP JackKnife 2.21 - '/(PHPJK) UserArea/NewAccounts/index.php?sAccountUnq' Cross-Site Scripting	2007-05-31
exploit-db	PHP JackKnife 2.21 - '(PHPJK) G_Display.php' Multiple Cross-Site Scripting Vulnerabilities	2007-05-31

References

→ the Explorer · watch your stack · NVD