CVE-2010-3070
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products,...
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
- Record
CVE-2010-3070- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
- Record
CVE-2010-3070- Updated
- 2026-11-02
EUVDEUVD-2010-3072 No score
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
- Record
EUVD-2010-3072- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fg9p-q5pm-9gpr No score
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products,...
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
- Record
GHSA-fg9p-q5pm-9gpr- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
- Record
CVE-2010-3070- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-3070 No score
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
- Record
DEBIAN-CVE-2010-3070- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nusoapDebian:12 |
before 0.7.3-4 | 0.7.3-4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | NuSOAP 0.9.5 - 'nusoap.php' Cross-Site Scripting | 2010-09-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3070 is a medium vulnerability (CVSS 4.3) in Dietrich Ayala Nusoap, published September 28, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.16%, the 93rd percentile. Fixed in nusoap 0.7.3-4.
References
openwall.com/lists/oss-security/2010/09/03/2
bugzilla.redhat.com/show_bug.cgi?id=629585
lists.fedoraproject.org/pipermail/package-announce/2010-September/048639.html
git.debian.org?p=users/olberger-guest/nusoap.git%3Ba=blob%3Bf=debian/patches/595248.patch%3Bh=6af3d725fe74d839764d9755c5bb18458a192518%3Bhb=268f03b88c6900d1a87b17734c248c705c22cb07
Show 23 moreShow less
secunia.com/advisories/41653
sourceforge.net/projects/nusoap/forums/forum/193579/topic/3834005
git.mantisbt.org?p=mantisbt.git%3Ba=commit%3Bh=edb817991b99cd5538f102be26865fde7c6b7212
bugs.debian.org/cgi-bin/bugreport.cgi?bug=595248
vupen.com/english/advisories/2010/2535
securityfocus.com/bid/42959
mantisbt.org/bugs/view.php?id=12312
nvd.nist.gov/vuln/detail/CVE-2010-3070
access.redhat.com/security/cve/CVE-2010-3070
github.com/advisories/GHSA-fg9p-q5pm-9gpr
security-tracker.debian.org/tracker/CVE-2010-3070