CVE-2007-6110
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to...
CVE-2007-6110 is a medium vulnerability (CVSS 4.3) in Htdig, published November 23, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.39%, the 91st percentile. Fixed in htdig 1:3.2.0b6-4.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 4.39%EPSS, 91st percentile
- Exploitation
- None known1 public exploit
- Fixed in
1:3.2.0b6-4htdig +23 more
Description
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
htdigDebian:12 | before 1:3.2.0b6-4 | 1:3.2.0b6-4 |
htdigDebian:13 | before 1:3.2.0b6-4 | 1:3.2.0b6-4 |
htdigDebian:14 | before 1:3.2.0b6-4 | 1:3.2.0b6-4 |
htdigDebian:4.0 | before 1:3.2.0b6-3.1etch1, plus listed versions 1:3.2.0b6-3.1 | 1:3.2.0b6-3.1etch1 |
htdigRed Hat:enterprise_linux:4::as | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-debuginfoRed Hat:enterprise_linux:4::as | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-webRed Hat:enterprise_linux:4::as | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdigRed Hat:enterprise_linux:4::desktop | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-debuginfoRed Hat:enterprise_linux:4::desktop | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-webRed Hat:enterprise_linux:4::desktop | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
htdigRed Hat:enterprise_linux:4::es | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-debuginfoRed Hat:enterprise_linux:4::es | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-webRed Hat:enterprise_linux:4::es | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdigRed Hat:enterprise_linux:4::ws | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-debuginfoRed Hat:enterprise_linux:4::ws | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdig-webRed Hat:enterprise_linux:4::ws | before 3:3.2.0b6-4.el4_6 | 3:3.2.0b6-4.el4_6 |
htdigRed Hat:enterprise_linux:5::client_workstation | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdig-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdig-webRed Hat:enterprise_linux:5::client_workstation | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdigRed Hat:enterprise_linux:5::client | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdig-debuginfoRed Hat:enterprise_linux:5::client | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdigRed Hat:enterprise_linux:5::server | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdig-debuginfoRed Hat:enterprise_linux:5::server | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
htdig-webRed Hat:enterprise_linux:5::server | before 3:3.2.0b6-9.0.1.el5_1 | 3:3.2.0b6-9.0.1.el5_1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ht://Dig 3.2 - Htsearch Cross-Site Scripting | 2007-11-27 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
- Record
CVE-2007-6110- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
- Record
CVE-2007-6110- Updated
- 2026-11-02
EUVDEUVD-2007-6079No score
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
- Record
EUVD-2007-6079- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fj22-9wc7-hq3hNo score
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to...
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
- Record
GHSA-fj22-9wc7-hq3h- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
- Record
CVE-2007-6110- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6110No score
Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
- Record
DEBIAN-CVE-2007-6110- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/27965
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11515
securitytracker.com/id?1019010
novell.com/linux/security/advisories/2007_25_sr.html
vupen.com/english/advisories/2007/4038
Show 17 moreShow less
redhat.com/support/errata/RHSA-2007-1095.html
securityfocus.com/bid/26610
sourceforge.net/mailarchive/forum.php?thread_name=200709251310.55835.mskibbe%40suse.de&forum_name=htdig-dev
debian.org/security/2007/dsa-1429
bugs.debian.org/cgi-bin/bugreport.cgi?bug=453278
nvd.nist.gov/vuln/detail/CVE-2007-6110
github.com/advisories/GHSA-fj22-9wc7-hq3h
security-tracker.debian.org/tracker/CVE-2007-6110
access.redhat.com/errata/RHSA-2007:1095
bugzilla.redhat.com/show_bug.cgi?id=399561
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1095.json
cve.org/CVERecord?id=CVE-2007-6110