CVE-2007-0146

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in (a) delete-announce.php; the (2) Announcement form field in (b) staff.php; the (3) Client Name, (4) Business Name, (5) Street, (6) Address 2, (7) Town/City, (8) Postcode, (9) Phone Number, (10) Email Address and (11) Website Address form fields in (c) new_customer.php; and unspecified fields in (d) search.php and (e) client-results.php.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Jan 9, 2007
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2007

CVE-2007-01475.0Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers CVE-2007-01486.8Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute aCVE-2007-01497.5EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download CVE-2007-01507.5Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URCVE-2007-01517.5MitiSoft stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databCVE-2007-01527.5OhhASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databasCVE-2007-01537.5AJLogin 3.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a daCVE-2007-01547.5Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databaCVE-2007-01557.5HarikaOnline 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downloadCVE-2007-01567.5M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request tCVE-2007-01577.8Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote mCVE-2007-01589.8thttpd 2007 has buffer underflow.
CVE-2007-0146: Medium severity, CVSS 6.0 | Vulnix