Unrated severityNVD Advisory· Published Mar 6, 2007· Updated Jun 16, 2026

CVE-2007-1287

Description

A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHP5 versions
cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:6.0:*:*:*:*:*:*:*
- (no CPE)range: >=4.4.3 <=4.4.6

Patches

Vulnerability mechanics

References

www.php-security.org/MOPB/MOPB-08-2007.htmlnvdExploitPatchVendor Advisory
docs.info.apple.com/article.htmlnvd
lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlnvd
secunia.com/advisories/26235nvd
us2.php.net/releases/4_4_7.phpnvd
www.osvdb.org/32774nvd
www.securityfocus.com/bid/25159nvd
www.vupen.com/english/advisories/2007/2732nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.003
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000