Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to i…

published 2007-02-13 19 y ago modified 2026-10-19 20 d ago also EUVD-2007-0892

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits: 1; Exploit-DB

Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed, a different vulnerability than CVE-2006-4712.

Patch / fix

fixed in 1

sage sage 1.3.10

Timeline

2007-02-09 First public exploit (EDB-29573)
2007-02-13 Published

Exploit prediction

2.74% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-29573 Sage 1.3.6 - Extension Feed HTML Injection remote, 2007-02-09

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

jvn.jp /jp/JVN%2384430861/index.html
third-party-advisory, vendor-advisory
secunia.com /advisories/24086
third-party-advisory, vendor-advisory, broken-link
osvdb.org /33131
vdb-entry, broken-link
securitytracker.com /id?1017624
vdb-entry, third-party-advisory
sage.mozdev.org /blog/archives/2007/1/sage_1_3_10_released.html
broken-link
securityfocus.com /bid/22493
vdb-entry, third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/32395
vdb-entry, third-party-advisory, permissions-required
mozdev.org /bugs/show_bug.cgi?id=16320
broken-link

Sources

CVE List CVE-2007-0896
NVD CVE-2007-0896

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary