end tag, which bypasses the pr","inLanguage":"en-US","identifier":"CVE-2007-1395","datePublished":"2007-03-10T22:19:00Z","dateModified":"2026-06-16T22:37:30.160000Z","about":{"@type":"Thing","name":"CVE-2007-1395","identifier":"CVE-2007-1395"},"isPartOf":{"@type":"WebSite","name":"GotRooted","url":"https://gotrooted.org/"},"publisher":{"@type":"Organization","name":"GotRooted","logo":{"@type":"ImageObject","url":"https://gotrooted.org/logo.png","width":640,"height":640}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://gotrooted.org/"},{"@type":"ListItem","position":2,"name":"cve","item":"https://gotrooted.org/cve"},{"@type":"ListItem","position":3,"name":"CVE 2007 1395","item":"https://gotrooted.org/cve/CVE-2007-1395"}]}]}

VULNERABILITY INTELLIGENCE

CVE-2007-1395

CVSS score4.3 MEDIUM
EPSS probability1.47%
CISA KEVNot currently listed
Published2007-03-10
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>.

Primary references