Description
Multiple cross-site scripting (XSS) vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) room parameter to sources/frame.php, the (2) theme_c parameter to help/index.php, or the (3) INSTALL_X7CHATVERSION parameter to upgradev1.php.
Exploits (2)
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/38745
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/38746
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27677
Various Sources x_refsource_misc
http://packetstorm.linuxsecurity.com/0711-exploits/x7-xss.txt
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/26417
Scores
EPSS
0.0568
EPSS Percentile
90.4%
Details
CWE
CWE-79
Status
published
Products (2)
x7_group/x7_chat
2.0.4
x7_group/x7_chat
2.0.5
Published
Nov 15, 2007
Tracked Since
Feb 18, 2026