CVE-2007-0660
DotNetNuke Vulnerable to XSS in Pass-Through Values
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."
- Record
CVE-2007-0660- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."
- Record
CVE-2007-0660- Updated
- 2026-11-02
EUVDEUVD-2022-5852 No score
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."
- Record
EUVD-2022-5852- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xr96-7ccp-pg5c No score
DotNetNuke Vulnerable to XSS in Pass-Through Values
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN), caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS. A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
- Record
GHSA-xr96-7ccp-pg5c- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-xr96-7ccp-pg5c No score
DotNetNuke Vulnerable to XSS in Pass-Through Values
Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN), caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS. A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
- Record
GHSA-xr96-7ccp-pg5c- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
DotNetNuke.CoreNuGet |
before 03.02.01 | 03.02.01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0660 is a medium vulnerability (CVSS 6.8) in Dotnetnuke Iframe, published February 1, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in DotNetNuke.Core 03.02.01.
References
exchange.xforce.ibmcloud.com/vulnerabilities/32037
dotnetnuke.com/Default.aspx?tabid=825&EntryID=1278
securityfocus.com/bid/22334
osvdb.org/36476
vupen.com/english/advisories/2007/0433
nvd.nist.gov/vuln/detail/CVE-2007-0660
web.archive.org/web/20071128032502/http://www.dotnetnuke.com/Default.aspx?tabid=825&EntryID=1278
github.com/advisories/GHSA-xr96-7ccp-pg5c