CVE-2007-1926

Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote authenticated users to inject arbitrary web script or HTML via (1) http or (2) ftp requests logged in /var/log/directadmin/security.log; (3) allows context-dependent attackers to inject arbitrary web script or HTML into /var/log/messages via a PHP script that invokes /usr/bin/logger; (4) allows local users to inject arbitrary web script or HTML into /var/log/messages by invoking /usr/bin/logger at the command line; and allows remote attackers to inject arbitrary web script or HTML via remote requests logged in the (5) /var/log/exim/rejectlog, (6) /var/log/exim/mainlog, (7) /var/log/proftpd/auth.log, (8) /var/log/httpd/error_log, (9) /var/log/httpd/access_log, (10) /var/log/directadmin/error.log, and (11) /var/log/directadmin/security.log files.

• CWE-79

• http://secunia.com/advisories/24728Exploit, Patch, Vendor Advisory
• http://securityreason.com/securityalert/2534Third Party Advisory
• http://www.directadmin.com/features.php?id=760Release Notes
• http://www.directadmin.com/versions.phpPatch
• http://www.securityfocus.com/archive/1/464471/100/100/threadedBroken Link
• http://www.securityfocus.com/bid/23254Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33390Third Party Advisory
• http://secunia.com/advisories/24728Exploit, Patch, Vendor Advisory
• http://securityreason.com/securityalert/2534Third Party Advisory
• http://www.directadmin.com/features.php?id=760Release Notes
• http://www.directadmin.com/versions.phpPatch
• http://www.securityfocus.com/archive/1/464471/100/100/threadedBroken Link
• http://www.securityfocus.com/bid/23254Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33390Third Party Advisory

Published

Apr 10, 2007

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1920SQL injection vulnerability in index.php in the aktualnosci …
• CVE-2007-1921LIBSNDFILE.DLL, as used by AOL Nullsoft Winamp 5.33 and poss…
• CVE-2007-1922The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules i…
• CVE-2007-1923(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement acces…
• CVE-2007-1924Multiple PHP remote file inclusion vulnerabilities in phpCon…
• CVE-2007-1925The borrado function in modules/Your_Account/index.php in Tr…
• CVE-2007-1927Cross-site scripting (XSS) vulnerability in signup.asp in Cm…
• CVE-2007-1928Directory traversal vulnerability in index.php in witshare 0…
• CVE-2007-1929Directory traversal vulnerability in downloadpic.php in Bery…
• CVE-2007-1930Directory traversal vulnerability in download2.php in cattaD…
• CVE-2007-1931SQL injection vulnerability in index.php in the slownik modu…
• CVE-2007-1932Directory traversal vulnerability in scarnews.inc.php in Sca…