{"api_version":"1","generated_at":"2026-07-23T04:36:27+00:00","cve":"CVE-2007-0302","urls":{"html":"https://cve.report/CVE-2007-0302","api":"https://cve.report/api/cve/CVE-2007-0302.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-0302","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-0302"},"summary":{"title":"CVE-2007-0302","description":"Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-01-18 00:28:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://securityreason.com/securityalert/2164","name":"http://securityreason.com/securityalert/2164","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityReason - InstantForum.NET Multiple Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/0227","name":"http://www.vupen.com/english/advisories/2007/0227","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/456970/100/0/threaded","name":"http://www.securityfocus.com/archive/1/456970/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/22052","name":"http://www.securityfocus.com/bid/22052","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"InstantForum.NET Multiple Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31521","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31521","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/23787","name":"http://secunia.com/advisories/23787","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"InstantForum.NET Members1.aspx and Logon.aspx Cross-Site Scripting - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/32853","name":"http://osvdb.org/32853","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/32852","name":"http://osvdb.org/32852","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-0302","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0302","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"302","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"instantasp","cpe5":"instantasp","cpe6":"4.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T12:12:17.983Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"22052","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/22052"},{"name":"23787","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/23787"},{"name":"32852","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/32852"},{"name":"2164","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/2164"},{"name":"ADV-2007-0227","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/0227"},{"name":"20070115 InstantForum.NET Multiple Cross-Site Scripting Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/456970/100/0/threaded"},{"name":"instantforum-multiple-scripts-xss(31521)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31521"},{"name":"32853","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/32853"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-01-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"22052","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/22052"},{"name":"23787","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/23787"},{"name":"32852","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/32852"},{"name":"2164","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/2164"},{"name":"ADV-2007-0227","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/0227"},{"name":"20070115 InstantForum.NET Multiple Cross-Site Scripting Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/456970/100/0/threaded"},{"name":"instantforum-multiple-scripts-xss(31521)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31521"},{"name":"32853","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/32853"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-0302","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"22052","refsource":"BID","url":"http://www.securityfocus.com/bid/22052"},{"name":"23787","refsource":"SECUNIA","url":"http://secunia.com/advisories/23787"},{"name":"32852","refsource":"OSVDB","url":"http://osvdb.org/32852"},{"name":"2164","refsource":"SREASON","url":"http://securityreason.com/securityalert/2164"},{"name":"ADV-2007-0227","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/0227"},{"name":"20070115 InstantForum.NET Multiple Cross-Site Scripting Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/456970/100/0/threaded"},{"name":"instantforum-multiple-scripts-xss(31521)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31521"},{"name":"32853","refsource":"OSVDB","url":"http://osvdb.org/32853"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-0302","datePublished":"2007-01-18T00:00:00.000Z","dateReserved":"2007-01-17T00:00:00.000Z","dateUpdated":"2024-08-07T12:12:17.983Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-01-18 00:28:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:instantasp:instantasp:4.1.0:*:*:*:*:*:*:*","matchCriteriaId":"24470F7C-79ED-4B07-8229-777E868060BA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"302","Ordinal":"1","Title":"CVE-2007-0302","CVE":"CVE-2007-0302","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"302","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to (a) Logon.aspx, and the (2) Username and (3) Update parameters to (b) Members1.aspx.","Type":"Description","Title":"CVE-2007-0302"},{"CveYear":"2007","CveId":"302","Ordinal":"2","NoteData":"2007-01-17","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"302","Ordinal":"3","NoteData":"2018-10-16","Type":"Other","Title":"Modified"}]}}}