CVE-2007-0896
Sage <1.3.10 - XSS
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed, a different vulnerability than CVE-2006-4712.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Fukumori · xmlremotemultiple
https://www.exploit-db.com/exploits/29573
References (8)
Scores
EPSS
0.0985
EPSS Percentile
93.0%
Details
CWE
CWE-79
Status
published
Products (4)
mozilla/firefox
sage/sage
sage/sage
1.0_beta_3
sage/sage
1.3.6
Published
Feb 13, 2007
Tracked Since
Feb 18, 2026