Servers and applications
CVE-2007-1926
Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote authenticated users to inject arbitrary web script or HTML via (1) http or (2) ftp requests logged in /var/log/directadmin/security.log; (3) allows context-dependent attackers to inject arbitrary web script or HTML into /var/log/messages via a PHP script…
- Severity
- Medium 6.8
- Published
- 10 Apr 2007
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 1.29.3
- Exploit chance
- 1.6% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Cross-site scripting (CWE-79)
- Attack
- Over the network · No login needed
- Attacker can
- Read some data · Change some data · Slow it down
- CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P- Sources
- NVD
Description
Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote authenticated users to inject arbitrary web script or HTML via (1) http or (2) ftp requests logged in /var/log/directadmin/security.log; (3) allows context-dependent attackers to inject arbitrary web script or HTML into /var/log/messages via a PHP script that invokes /usr/bin/logger; (4) allows local users to inject arbitrary web script or HTML into /var/log/messages by invoking /usr/bin/logger at the command line; and allows remote attackers to inject arbitrary web script or HTML via remote requests logged in the (5) /var/log/exim/rejectlog, (6) /var/log/exim/mainlog, (7) /var/log/proftpd/auth.log, (8) /var/log/httpd/error_log, (9) /var/log/httpd/access_log, (10) /var/log/directadmin/error.log, and (11) /var/log/directadmin/security.log files.
Affected software
| Software | Affected versions |
|---|---|
DirectAdminServers and applications · cpe:a:directadmin:directadmin |
|