CVE-2007-6405
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to...
CVE-2007-6405 is a medium vulnerability (CVSS 6.4) in Shttpd, published December 17, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 86th percentile. No source names a fixed version.
- Severity
- 6.4 MediumCVSS 2.0, NVD
- Exploit chance
- 2.67%EPSS, 86th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Simple HTTPd 1.38 - Multiple Vulnerabilities | 2007-12-07 |
What each source reports
NVD Score used
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
- Record
CVE-2007-6405- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
- Record
CVE-2007-6405- Updated
- 2026-11-02
EUVDEUVD-2007-6371No score
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
- Record
EUVD-2007-6371- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4gq-m5g6-gq3vNo score
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to...
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
- Record
GHSA-x4gq-m5g6-gq3v- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/archive/1/484761/100/0/threaded
securityreason.com/securityalert/3457
exploit-db.com/exploits/4700
osvdb.org/44119
sourceforge.net/mailarchive/forum.php?thread_name=20071203130540.6e482c20.aluigi%40autistici.org&forum_name=shttpd-general
aluigi.altervista.org/adv/shttpd-adv.txt
nvd.nist.gov/vuln/detail/CVE-2007-6405
github.com/advisories/GHSA-x4gq-m5g6-gq3v