CVE-2007-1499

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 30.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-03-17 · updated 2026-06-16
Weakness: CWE-79

Description

Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."

Affected products

Microsoft Ie: 7.0

References

http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx
http://news.com.com/2100-1002_3-6167410.html
http://osvdb.org/35352
http://secunia.com/advisories/24535
http://secunia.com/advisories/25627
http://securityreason.com/securityalert/2448
http://securitytracker.com/id?1018235
http://www.securityfocus.com/archive/1/462833/100/0/threaded
http://www.securityfocus.com/archive/1/462939/100/0/threaded
http://www.securityfocus.com/archive/1/462945/100/0/threaded
http://www.securityfocus.com/archive/1/471947/100/0/threaded
http://www.securityfocus.com/bid/22966

Get alerted when CVE-2007-1499 or the next vulnerability affects your stack