$ cve CVE-2007-3594 JSON

CVE-2007-3594 EXPLOIT

2.6

LOW · CVSS 2.0 · EPSS 5.8% (pctl 93)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in AdventNet ManageEngine OpManager 6 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter in (a) ping.do and (b) traceRoute.do in map/; the (2) reportName, (3) displayName, and (4) selectedNode parameters to (c) reports/ReportViewAction.do; the (5) operation parameter to (d) admin/ServiceConfiguration.do; and the (6) selectedNode and (7) selectedTab parameters to (e) admin/DeviceAssociation.do. NOTE: the searchTerm parameter in Search.do is already covered by CVE-2006-2343.

Scoring

CVSS	2.6 (LOW, v2.0)
Vector	AV:N/AC:H/Au:N/C:N/I:P/A:N
EPSS	5.77% — more likely to be exploited than 93% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-07-06
Last modified	2026-06-16

Affected (1)

Vendor	Product
adventnet	manageengine netflow analyzer

Public exploits

Source	Title	Date
exploit-db	OpManager 6/7 - 'ping.do?name' Cross-Site Scripting	2007-07-04
exploit-db	OpManager 6/7 - 'traceRoute.do?name' Cross-Site Scripting	2007-07-04
exploit-db	OpManager 6/7 - reports/ReportViewAction.do Multiple Cross-Site Scripting Vulnerabilities	2007-07-04
exploit-db	OpManager 6/7 - 'admin/ServiceConfiguration.do?Operation' Cross-Site Scripting	2007-07-04
exploit-db	OpManager 6/7 - '/admin/DeviceAssociation.do' Multiple Cross-Site Scripting Vulnerabilities	2007-07-04

References

→ the Explorer · watch your stack · NVD