CVE-2007-2060 json
Cross-zone scripting vulnerability in the Wizz RSS Reader before 2.1.9 extension to Mozilla Firefox allows remote attackers to execute arbi…
published 2007-04-18 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-2055
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
Cross-zone scripting vulnerability in the Wizz RSS Reader before 2.1.9 extension to Mozilla Firefox allows remote attackers to execute arbitrary Javascript in the browser chrome via the RSS feed DOM.
Patch / fix
- kb.cert.org/vuls/id/319464 advisory
Exploit prediction
3.17% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
-
kb.cert.org
/vuls/id/319464
third-party-advisory, patch, us-government-resource
-
vupen.com
/english/advisories/2007/1425
vdb-entry
-
securityfocus.com
/bid/23523
vdb-entry
- kb.cert.org /vuls/id/MIMG-6ZKP4T
-
secunia.com
/advisories/24913
third-party-advisory
-
osvdb.org
/34534
vdb-entry
- addons.mozilla.org /en-US/firefox/addon/424
-
exchange.xforce.ibmcloud.com
/vulnerabilities/33693
vdb-entry
- wizzrss.blat.co.za /2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/
Sources
- CVE List CVE-2007-2060
- NVD CVE-2007-2060
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.