CVE-2007-5127

SimpGB 1.46.02 - Cross-Site Scripting via l_username or l_emoticonlist Parameter

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2007-5127. PoCs published by netVigilance.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in SimpGB 1.46.02 by injecting arbitrary JavaScript code via the 'l_emoticonlist' parameter in the admin/emoticonlist.php file. The PoC uses a simple alert to display the document cookies, proving the vulnerability.

Description

Multiple cross-site scripting (XSS) vulnerabilities in SimpGB 1.46.02 allow remote attackers to inject arbitrary web script or HTML via (1) the l_username parameter to the default URI under admin/ or (2) the l_emoticonlist parameter to admin/emoticonlist.php.

Exploits (2)

exploitdb WORKING POC VERIFIED

by netVigilance · textwebappsphp

https://www.exploit-db.com/exploits/30616

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in SimpGB 1.46.02 by injecting arbitrary JavaScript code via the 'l_emoticonlist' parameter in the admin/emoticonlist.php file. The PoC uses a simple alert to display the document cookies, proving the vulnerability.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: SimpGB 1.46.02

No auth needed

Prerequisites: Access to the target URL · User interaction to trigger the XSS

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →