CVE-2007-4081
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 3.2%
from disclosure to weapon0 days
Published on NVDJul 30
1st PoCJul 23
exploitation probability
3.2%top 13% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter. NOTE: vector 7 might overlap CVE-2005-3795.1.
Affected products
n/a · n/apublic PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30369exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30370⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.