CVE-2007-1394

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-03-10 · updated 2026-06-16

Description

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.

Affected products

Flat Chat: 2.0

References

http://osvdb.org/33890
http://secunia.com/advisories/24433
http://www.securityfocus.com/bid/22865
http://www.vupen.com/english/advisories/2007/0871
https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
https://www.exploit-db.com/exploits/3428
http://osvdb.org/33890
http://secunia.com/advisories/24433
http://www.securityfocus.com/bid/22865
http://www.vupen.com/english/advisories/2007/0871
https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
https://www.exploit-db.com/exploits/3428

Get alerted when CVE-2007-1394 or the next vulnerability affects your stack