CVE-2007-3060

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-06-06 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to (a) chat.php, (2) LANG[DEFAULT_BRANDING] and (3) PHPLIVE_VERSION parameters to (b) help.php, the (4) admin[name] parameter to (c) admin/header.php, and the (5) BASE_URL parameter to (d) super/info.php, and in some cases, the LANG[DEFAULT_BRANDING], PHPLIVE_VERSION, and (6) nav_line parameters to setup/footer.php, different vectors than CVE-2006-6769.

Affected products

Osi Codes Inc. Phplive: 3.2.2

References

http://marc.info/?l=full-disclosure&m=118072121020357&w=2
http://osvdb.org/36986
http://osvdb.org/36987
http://osvdb.org/36988
http://osvdb.org/36989
http://osvdb.org/36990
http://osvdb.org/38379
http://osvdb.org/38380
http://osvdb.org/38381
http://osvdb.org/38382
http://osvdb.org/38383
http://secunia.com/advisories/25441

Get alerted when CVE-2007-3060 or the next vulnerability affects your stack