CVE-2007-0177

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/31525
http://secunia.com/advisories/23647Vendor Advisory
http://secunia.com/advisories/24889
http://sourceforge.net/forum/forum.php?forum_id=652721Patch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_9/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_7_2/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_8_3/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0RC2/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2007_6_sr.html
http://www.securityfocus.com/bid/21956Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2007/0096
https://exchange.xforce.ibmcloud.com/vulnerabilities/31359
http://osvdb.org/31525
http://secunia.com/advisories/23647Vendor Advisory
http://secunia.com/advisories/24889
http://sourceforge.net/forum/forum.php?forum_id=652721Patch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_9/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_7_2/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_8_3/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0RC2/phase3/RELEASE-NOTESPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2007_6_sr.html
http://www.securityfocus.com/bid/21956Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2007/0096
https://exchange.xforce.ibmcloud.com/vulnerabilities/31359

Timeline

Published: Jan 11, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-01787.5PHP remote file inclusion vulnerability in info.php in Easy Banner Pro 2.8 allows remote attackers to execute arbitrary PHP code via a URL i CVE-2007-01797.5SQL injection vulnerability in comment.php in PHPKIT 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the subid parame CVE-2007-01807.6Stack-based buffer overflow in EF Commander 5.75 allows user-assisted attackers to execute arbitrary code via a crafted ISO file containing CVE-2007-01817.5PHP remote file inclusion vulnerability in include/common_function.php in magic photo storage website allows remote attackers to execute arb CVE-2007-01827.5Multiple PHP remote file inclusion vulnerabilities in magic photo storage website allow remote attackers to execute arbitrary PHP code via a CVE-2007-01836.8Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML CVE-2007-01847.5Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that CVE-2007-01855.0Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unk CVE-2007-01866.8Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via CVE-2007-01877.5F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading s CVE-2007-01886.5F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation CVE-2007-01897.5PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code