CVE-2007-6726
Apache Struts Dojo Plugin XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
- Record
CVE-2007-6726- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
- Record
CVE-2007-6726- Updated
- 2026-11-02
EUVDEUVD-2022-5192 No score
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
- Record
EUVD-2022-5192- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rm26-w253-9qv7 No score
Apache Struts Dojo Plugin XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
- Record
GHSA-rm26-w253-9qv7- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-rm26-w253-9qv7 No score
Apache Struts Dojo Plugin XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
- Record
GHSA-rm26-w253-9qv7- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-dojo-pluginMaven |
0.4.1 to 0.4.2 | 0.4.3 |
org.apache.struts:struts2-dojo-pluginMaven |
0.4.1 up to 0.4.3 | 0.4.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6726 is a medium vulnerability (CVSS 4.3) in Apache Struts, published April 9, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.45%, the 89th percentile. Fixed in org.apache.struts:struts2-dojo-plugin 0.4.3.
References
dojotoolkit.org/releaseNotes/0.4.3
exchange.xforce.ibmcloud.com/vulnerabilities/49884
issues.apache.org/struts/browse/WW-2134
securityfocus.com/bid/34660
nvd.nist.gov/vuln/detail/CVE-2007-6726
github.com/advisories/GHSA-rm26-w253-9qv7