CVE-2007-5370

Netwin Dnewsweb - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/dnewsweb.exe in NetWin DNewsWeb (DNews News Server) 57e1 allow remote attackers to inject arbitrary web script or HTML via the (1) group or (2) utag parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Doz · textwebappscgi

https://www.exploit-db.com/exploits/30649

View Code ZIP pw:eip

References (7)

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/37031

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/481865/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/25981

[Third Party Advisory, VDB Entry] http://osvdb.org/37651

[Third Party Advisory] http://secunia.com/advisories/27163

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/3452

[Third Party Advisory] http://securityreason.com/securityalert/3208

Scores

EPSS 0.0076

EPSS Percentile 73.1%

Classification

CWE

CWE-79

Status draft

Affected Products (1)

netwin/dnewsweb

Timeline

Published Oct 11, 2007

Tracked Since Feb 18, 2026