CVEvulnerability

CVE-2007-5727

4.3 MEDIUM Published 2007-10-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-10-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.

Affected configurations

• oneorzero oneorzero helpdesk 1.6.4.2 • oneorzero oneorzero helpdesk 1.6.5.4

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

Referenced by CWE · observed example (3)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-692 Incomplete Denylist to Cross-Site Scripting weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References