CVE-2007-0896

Medium

Published: 13/02/2007(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.94%

80th percentile - higher than 80% of all known CVEs

Summary

The Sage extension before 1.3.10 and Sage++ extensions for Firefox contain a cross-site scripting (XSS) vulnerability. A remote attacker can inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed.

Risk Assessment

An attacker can execute arbitrary JavaScript in the user's browser context, potentially leading to session or data theft.

Recommendation

Update the Sage and Sage++ extensions to version 1.3.10 or later.

Other vulnerabilities in Sage

CVE-2022-38583High
A vulnerability in Sage 300 (versions 2017-2022) configured in a Windows Peer-to-Peer or Client Server Network allows a low-privileged workstation user to access the SharedData folder on the server. This enables viewing and modifying credentials of Sage 300 users and SQL accounts, leading to user impersonation and system administrator-level access to the MS SQL database.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed, a different vulnerability than CVE-2006-4712.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS