CVE-2007-0119 Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to (1) mkpw_mp.cgi, (2) mkpw.pl, or (3) mkpw.cg...

MediumCVSS 6.8 EPSS 2.1%

Published: 2007-01-09 04:00
Updated: 2026-06-17 01:34
Exploit status: No public exploit known

Description

Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to (1) mkpw_mp.cgi, (2) mkpw.pl, or (3) mkpw.cgi.

Affected products

Product	Affected versions	Fixed in
edittag	= 1.2	No fix listed

References

33390 vdb-entry
33391 vdb-entry
33392 vdb-entry
7950 third-party-advisory
20070105 Multiple bugs in EditTag mailing-list
21891 exploit vdb-entry vendor-advisory

CVSS v2.0

6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.14% (percentile 82.3)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

EditTag 1.2 - 'mkpw.cgi?plain' Cross-Site Scripting Exploit · Exploit Database (OffSec) · 2007-01-05
EditTag 1.2 - 'mkpw.pl?plain' Cross-Site Scripting Exploit · Exploit Database (OffSec) · 2007-01-05
EditTag 1.2 - 'mkpw_mp.cgi?plain' Cross-Site Scripting Exploit · Exploit Database (OffSec) · 2007-01-05