CVE-2007-3101

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces...

4.3 MediumPublic exploit

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.

Exploit likelihood

44.5%Up 36.9 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2007-3101
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-3101
Updated: 2026-11-02

EUVDEUVD-2007-3093 No score

Record: EUVD-2007-3093
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f2rh-9mv9-vrw7 No score

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces...

Record: GHSA-f2rh-9mv9-vrw7
Updated: 2026-11-02

Affected products

apache myfaces tomahawk

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache MyFaces Tomahawk JSF Framework 1.1.5 - 'Autoscroll' Cross-Site Scripting	2007-06-14

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	aliases, exploits, facts, references, title	Exploit-DB, GitHub Advisories
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-3101 is a medium vulnerability (CVSS 4.3) in Apache Myfaces Tomahawk, published June 18, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 44.5%, the 98th percentile. No source names a fixed version.