CVE-2007-0896
Sage <1.3.10 - XSS
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed, a different vulnerability than CVE-2006-4712.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Fukumori · xmlremotemultiple
https://www.exploit-db.com/exploits/29573
References (8)
Scores
EPSS
0.0932
EPSS Percentile
92.6%
Classification
CWE
CWE-79
Status
draft
Affected Products (4)
mozilla/firefox
sage/sage
sage/sage
sage/sage
Timeline
Published
Feb 13, 2007
Tracked Since
Feb 18, 2026