$ cve CVE-2007-4088 JSON

CVE-2007-4088 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 4.4% (pctl 91)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) f, (3) quote, and (4) act parameters to cp.php; the (5) u parameter to user.php; the (6) f parameter to post.php; the (7) s parameter to topic.php; the (8) quote, (9) t, (10) poll, and (11) p parameters to post.php; the (12) Message Title field of a private message (PM) in mode 6 of cp.php; the (13) title field of a private message (PM) in mode 7 of cp.php; and (14) allow user-assisted remote attackers to inject arbitrary web script or HTML via a dosearch action to search.php, which reflects the first lines of all posts by a user. NOTE: the act parameter to help.php and the p parameter to report.php are already covered by CVE-2006-4708. NOTE: vectors 12 and 13 might overlap CVE-2006-6283.1. NOTE: vector 14 might overlap CVE-2006-4708.b.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	4.38% — more likely to be exploited than 91% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-07-30
Last modified	2026-06-16

Affected (1)

Vendor	Product
vikingboard	vikingboard

Public exploits

Source	Title	Date
exploit-db	Vikingboard 0.1.2 - 'cp.php' Cross-Site Scripting	2007-07-25
exploit-db	Vikingboard 0.1.2 - 'user.php' Cross-Site Scripting	2007-07-25
exploit-db	Vikingboard 0.1.2 - 'post.php' Cross-Site Scripting	2007-07-25
exploit-db	Vikingboard 0.1.2 - 'topic.php' Cross-Site Scripting	2007-07-25

References

→ the Explorer · watch your stack · NVD