CVE-2007-5727 - CVE House
Back to Database
Status published Medium CVE-2007-5727

Incomplete blacklist vulnerability in the stripScripts function in common.php in...

Vulnerability Description

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-5727

Credits & Attribution

No credits recorded in the NVD database.

References

More from oneorzero

View All →
CVE-2012-0989
Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2.8.0 Trial Edition...
Medium 4.3
CVE-2011-4215
SQL injection vulnerability in lib/ooz_access.php in OneOrZero Action & Information...
High 7.5
CVE-2011-4214
OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote...
Critical 10
CVE-2010-4835
Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members...
Medium 4
CVE-2010-4834
Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0...
Medium 6.5

Affected Vendor

Affected Software

oneorzero helpdesk
Vulnerable Versions:
1.6.4.2, 1.6.5.4

Timeline

Official Publish: October 30th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.