CVE-2002-0243 Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.

HighCVSS 7.5 EPSS 1.4%

Published: 2002-05-03 07:00
Updated: 2026-06-17 00:57
Exploit status: No public exploit known

Description

Cross-site scripting vulnerability in Opera 6.0 and earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed.

Affected products

Product	Affected versions	Fixed in
opera software opera web browser	<= 6.0	No fix listed

References

20020207 Web Browsers vulnerable to the Extended HTML Form Attack (IE and OPERA) mailing-list

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.37% (percentile 72.2)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.