CVE-2007-3963

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-07-25 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF) to (1) upgrade-0-2-3.php, (2) upgrade-0-3.php, or (3) upgrade-0-4.php in install/, a different vulnerability than CVE-2005-4193.

Affected products

UseBB: 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+5)

References

http://securityreason.com/securityalert/2915
http://www.securityfocus.com/archive/1/474256/100/0/threaded
http://www.securityfocus.com/bid/24990
http://securityreason.com/securityalert/2915
http://www.securityfocus.com/archive/1/474256/100/0/threaded
http://www.securityfocus.com/bid/24990

Get alerted when CVE-2007-3963 or the next vulnerability affects your stack