CVE-2007-1394

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.

• http://osvdb.org/33890
• http://secunia.com/advisories/24433Exploit, Vendor Advisory
• http://www.securityfocus.com/bid/22865Exploit, Vendor Advisory
• http://www.vupen.com/english/advisories/2007/0871
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
• https://www.exploit-db.com/exploits/3428
• http://osvdb.org/33890
• http://secunia.com/advisories/24433Exploit, Vendor Advisory
• http://www.securityfocus.com/bid/22865Exploit, Vendor Advisory
• http://www.vupen.com/english/advisories/2007/0871
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
• https://www.exploit-db.com/exploits/3428

Published

Mar 10, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1388The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c …
• CVE-2007-1389dynaliens 2.0 and 2.1 allows remote attackers to bypass auth…
• CVE-2007-1390Multiple cross-site scripting (XSS) vulnerabilities in dynal…
• CVE-2007-1391PHP remote file inclusion vulnerability in modules/abook/fol…
• CVE-2007-1392Directory traversal vulnerability in down.php in netForo! 0.…
• CVE-2007-1393PHP remote file inclusion vulnerability in mysave.php in Mag…
• CVE-2007-1395Incomplete blacklist vulnerability in index.php in phpMyAdmi…
• CVE-2007-1396The import_request_variables function in PHP 4.0.7 through 4…
• CVE-2007-1397Multiple stack-based buffer overflows in the (1) ExtractRnic…
• CVE-2007-1398The frag3 preprocessor in Snort 2.6.1.1, 2.6.1.2, and 2.7.0 …
• CVE-2007-1399Stack-based buffer overflow in the zip:// URL wrapper in PEC…9.8
• CVE-2007-1400Plash permits sandboxed processes to open /dev/tty, which al…