CVE-2007-1499
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct...
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
- Record
CVE-2007-1499- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
- Record
CVE-2007-1499- Updated
- 2026-11-02
EUVDEUVD-2007-1493 No score
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
- Record
EUVD-2007-1493- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cjh8-4rc2-q72f No score
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct...
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
- Record
GHSA-cjh8-4rc2-q72f- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Internet Explorer 7 - NavCancel.HTM Cross-Site Scripting | 2007-03-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1499 is a medium vulnerability (CVSS 4.3) in Microsoft Ie, published March 17, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 30.0%, the 98th percentile. No source names a fixed version.
References
securityfocus.com/bid/22966
securityreason.com/securityalert/2448
osvdb.org/35352
vupen.com/english/advisories/2007/0946
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1715
secunia.com/advisories/25627
Show 14 moreShow less
aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx
exchange.xforce.ibmcloud.com/vulnerabilities/33026
securitytracker.com/id?1018235
us-cert.gov/cas/techalerts/TA07-163A.html
news.com.com/2100-1002_3-6167410.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033
nvd.nist.gov/vuln/detail/CVE-2007-1499
github.com/advisories/GHSA-cjh8-4rc2-q72f