Unrated severityNVD Advisory· Published Mar 10, 2007· Updated Jun 16, 2026

CVE-2007-1394

Description

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Flat Chat/Flat Chat2 versions
cpe:2.3:a:flat_chat:flat_chat:2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:flat_chat:flat_chat:2.0:*:*:*:*:*:*:*
- (no CPE)range: = 2.0

Patches

Vulnerability mechanics

References

secunia.com/advisories/24433nvdExploitVendor Advisory
www.securityfocus.com/bid/22865nvdExploitVendor Advisory
osvdb.org/33890nvd
www.vupen.com/english/advisories/2007/0871nvd
exchange.xforce.ibmcloud.com/vulnerabilities/32882nvd
www.exploit-db.com/exploits/3428nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.003
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000