CVE-2007-5727 Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripti...

MediumCVSS 4.3 EPSS 1.9%

Published: 2007-10-30 23:00
Updated: 2026-06-17 01:46
Exploit status: No public exploit known

Description

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.

Affected products

Product	Affected versions	Fixed in
oneorzero helpdesk	= 1.6.4.2	No fix listed
oneorzero helpdesk	= 1.6.5.4	No fix listed

References

38215 vdb-entry
38836 vdb-entry
27415 third-party-advisory vendor-advisory
3320 third-party-advisory
20071022 usd250 helpdesk XSS vulnerabily. mailing-list
26208 vdb-entry
26217 vdb-entry

CVSS v2.0

4.3 Medium

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: None
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.92% (percentile 80.2)
CWE: CWE-79

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.