{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-03-19T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2007-05-10T09:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2007-1005", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1005"}, {"tags": ["x_refsource_MISC"], "url": "http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt"}, {"name": "23027", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23027"}, {"name": "25108", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/25108"}, {"name": "24567", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24567"}, {"name": "DSA-1285", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2007/dsa-1285"}, {"tags": ["x_refsource_MISC"], "url": "http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-1622", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2007-1005", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1005"}, {"name": "http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt", "refsource": "MISC", "url": "http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt"}, {"name": "23027", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23027"}, {"name": "25108", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/25108"}, {"name": "24567", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24567"}, {"name": "DSA-1285", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2007/dsa-1285"}, {"name": "http://sla.ckers.org/forum/read.php?2,7935#msg-8006", "refsource": "MISC", "url": "http://sla.ckers.org/forum/read.php?2,7935#msg-8006"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:06:25.098Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2007-1005", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/1005"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt"}, {"name": "23027", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23027"}, {"name": "25108", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/25108"}, {"name": "24567", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/24567"}, {"name": "DSA-1285", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2007/dsa-1285"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-1622", "datePublished": "2007-03-23T00:00:00", "dateReserved": "2007-03-22T00:00:00", "dateUpdated": "2024-08-07T13:06:25.098Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "BDCFE9AA-39E9-4366-AAB7-F7A891BC797E", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "BAF4671A-8449-438E-922B-94E5542137BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "92F05A1F-2227-4166-807B-1BDE2EA8F245", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "0CF73E23-7CD0-429C-986B-5F721F1696BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "EECE66B3-3696-4E98-AF63-DF2FB256A6FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "E75BB382-6B47-4C6A-BF94-80443BEB1A23", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "EFA75368-506F-4772-B0F2-8AAECDF288F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "FDDD9E5C-766F-4945-B87D-781E780AB03E", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "B2A0CAEE-5C14-44C6-85FB-6AFDAAA1C3F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.0.10_rc1:*:*:*:*:*:*:*", "matchCriteriaId": "77D85664-E355-4A68-89EB-D5C9D0E6B916", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "8A3624D4-E666-4A1B-B465-714ACBA0034C", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "7A7CBC45-320E-48CF-9A63-07DDE2FB61BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "266E32CD-66FB-4E19-8091-EC748B177D8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:2.1.3_rc1:*:*:*:*:*:*:*", "matchCriteriaId": "14B0A9E4-9D09-4127-AF8B-4DA6D488E67C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF."}, {"lang": "es", "value": "Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en wp-admin/vars.php en WordPress anterior a 2.0.10 RC2, y anterior a 2.1.3 RC2 en las series 2.1, permite a usuarios remotos validados con privlegios de tema inyectar secuencias de comandos web o HTML a trav\u00e9s de PATH_INFO en la interfaz de administrador, relacionado con el proceso regular el flujo de la expresi\u00f3n de PHP_SELF."}], "id": "CVE-2007-1622", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-03-23T00:19:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/24567"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/25108"}, {"source": "cve@mitre.org", "url": "http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2007/dsa-1285"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/23027"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/1005"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/24567"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/25108"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2007/dsa-1285"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/23027"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/1005"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}