CVE-2007-1966
9.1 · CRITICALSession fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie.
Overview
CVE-2007-1966 is a critical-severity vulnerability affecting exv2 content_management_system. It was published on April 11, 2007 and has a CVSS 3.1 base score of 9.1 (CRITICAL).
This vulnerability has a CVSS 3.1 base score of 9.1, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie.
Remediation
Check the references section for vendor advisories and patches from exv2. Update content_management_system to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2007-1966?
CVE-2007-1966 is a critical-severity vulnerability affecting exv2 content_management_system. It was published on April 11, 2007 and has a CVSS 3.1 base score of 9.1 (CRITICAL).
How severe is CVE-2007-1966?
This vulnerability has a CVSS 3.1 base score of 9.1, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2007-1966?
Check the references section for vendor advisories and patches from exv2. Update content_management_system to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2007-1966?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2007-1966 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related CRITICAL CVEs from 2007
View all- 9.8CVE-2007-0681
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrar
View details - 9.8CVE-2006-6975
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote atta
View details - 9.8CVE-2006-7079
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote at
View details - 9.8CVE-2006-7105
PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attac
View details - 9.8CVE-2007-1383
Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attacker
View details - 9.8CVE-2007-1399
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with
View details - 9.8CVE-2007-2020
Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute ar
View details - 9.8CVE-2007-2422
Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One
View details - 9.8CVE-2007-2534
Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arb
View details - 9.8CVE-2007-3194
Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to exec
View details - 9.8CVE-2007-3798
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote atta
View details - 9.8CVE-2007-4039
Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote
View details