CVE-2007-3198 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 2.5% (pctl 84)
Patch early
A public exploit exists.
Description
Cross-site scripting (XSS) vulnerability in comments.php in Maran PHP Blog (Maran Blog), possibly only versions before 20070610, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 2.49% — more likely to be exploited than 84% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-06-12 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| maran | php blog |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Maran PHP Blog - 'comments.php' Cross-Site Scripting | 2008-07-21 |
References
- http://osvdb.org/35374
- http://secunia.com/advisories/25616
- http://securityreason.com/securityalert/2797
- http://www.securityfocus.com/archive/1/471046/100/0/threaded
- http://www.securityfocus.com/archive/1/494549/100/0/threaded
- http://www.securityfocus.com/bid/24409
- http://www.securityfocus.com/bid/30309
- http://www.secvsn.com/content/Advisories/sr-060607-maran.html
- http://www.vupen.com/english/advisories/2007/2148
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34812
- http://osvdb.org/35374
- http://secunia.com/advisories/25616
- http://securityreason.com/securityalert/2797
- http://www.securityfocus.com/archive/1/471046/100/0/threaded
- http://www.securityfocus.com/archive/1/494549/100/0/threaded
- http://www.securityfocus.com/bid/24409
- http://www.securityfocus.com/bid/30309
- http://www.secvsn.com/content/Advisories/sr-060607-maran.html
- http://www.vupen.com/english/advisories/2007/2148
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34812
→ the Explorer · watch your stack · NVD