HTML Purifier Cross-site Scripting vulnerability

MEDIUM 4.3CVE-2007-3498 · GHSA-6fh7-fwqj-mv49 · Published 29/06/2007 · updated 16/06/2026

In short

CVE-2007-3498 is a MEDIUM (CVSS 4.3) vulnerability affecting ezyang/htmlpurifier, htmlpurifier (htmlpurifier).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.8% of all vulnerabilities.
Fix: update to 2.0.1 or later.

Package	Affected versions	Patched versions
ezyang/htmlpurifier Packagist	`< 2.0.1`	`2.0.1`
htmlpurifier htmlpurifier	`= 2.0.0`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped print_r output."

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2007-3498 · ADVISORY
ezyang/htmlpurifier commit 96b571d · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/35300 · WEB
ezyang/htmlpurifier · PACKAGE
ezyang/htmlpurifier · WEB
web.archive.org/web/20200228110020/http://www.securityfocus.com/bid/24699 · WEB
htmlpurifier.org/svnroot/htmlpurifier/tags/2.0.1/NEWS · WEB
osvdb.org/36722
securityfocus.com/bid/24699

More vulnerabilities in ezyang/htmlpurifier

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ezyang/htmlpurifier

Packagist

< 2.0.1

2.0.1

htmlpurifier

= 2.0.0

No fix yet

Description

NVD description

More vulnerabilities in ezyang/htmlpurifier

See all →