CVE-2007-5577

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via the (1) Title or (2) Section Name form fields in the Section Manager component, or (3) multiple unspecified fields in New Menu Item.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=5654Patch, Vendor Advisory
http://osvdb.org/37173Broken Link
http://secunia.com/advisories/25804Patch, Vendor Advisory
http://www.joomla.org/content/view/3670/78/Release Notes, Vendor Advisory
http://www.joomla.org/content/view/3677/1/Vendor Advisory
http://www.securityfocus.com/bid/24663Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35119Third Party Advisory, VDB Entry
http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=5654Patch, Vendor Advisory
http://osvdb.org/37173Broken Link
http://secunia.com/advisories/25804Patch, Vendor Advisory
http://www.joomla.org/content/view/3670/78/Release Notes, Vendor Advisory
http://www.joomla.org/content/view/3677/1/Vendor Advisory
http://www.securityfocus.com/bid/24663Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35119Third Party Advisory, VDB Entry

Timeline

Published: Oct 18, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-55787.5Basic Analysis and Security Engine (BASE) before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers CVE-2007-55797.5login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowle CVE-2007-558010.0Buffer overflow in a certain driver in Cisco Security Agent 4.5.1 before 4.5.1.672, 5.0 before 5.0.0.225, 5.1 before 5.1.0.106, and 5.2 befo CVE-2007-55814.3Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow rem CVE-2007-55824.3Cross-site scripting (XSS) vulnerability in the login page in Cisco CiscoWorks Server (CS), possibly 2.6 and earlier, when using CiscoWorks CVE-2007-55837.8Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service ("486 Busy" responses or device reboot) CVE-2007-55847.8Unspecified vulnerability in Cisco Firewall Services Module (FWSM) 3.2(3) allows remote attackers to cause a denial of service (device reloa CVE-2007-55855.0xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-help CVE-2007-55876.9Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2,CVE-2007-55884.3Cross-site scripting (XSS) vulnerability in mnoGoSearch before 3.2.43 allows remote attackers to inject arbitrary web script or HTML via the CVE-2007-55894.3Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or H CVE-2007-55906.8Multiple buffer overflows in Miranda before 0.7.1 allow remote attackers to execute arbitrary code via unspecified vectors involving (1) IRC