CVE-2007-3786

Cross-site request forgery (CSRF) vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a former customer

• http://labs.calyptix.com/CX-2007-05.phpPatch, Vendor Advisory
• http://labs.calyptix.com/CX-2007-05.txtPatch, Vendor Advisory
• http://osvdb.org/38174
• http://secunia.com/advisories/26005
• http://www.eweek.com/article2/0%2C1759%2C2154646%2C00.asp
• http://www.securityfocus.com/archive/1/473663/100/0/threaded
• http://www.vupen.com/english/advisories/2007/2539
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35372
• http://labs.calyptix.com/CX-2007-05.phpPatch, Vendor Advisory
• http://labs.calyptix.com/CX-2007-05.txtPatch, Vendor Advisory
• http://osvdb.org/38174
• http://secunia.com/advisories/26005
• http://www.eweek.com/article2/0%2C1759%2C2154646%2C00.asp
• http://www.securityfocus.com/archive/1/473663/100/0/threaded
• http://www.vupen.com/english/advisories/2007/2539
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35372

Published

Jul 15, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-3780MySQL Community Server before 5.0.45 allows remote attackers…
• CVE-2007-3781MySQL Community Server before 5.0.45 does not require privil…
• CVE-2007-3782MySQL Community Server before 5.0.45 allows remote authentic…
• CVE-2007-3783SQL injection vulnerability in default.asp in enVivo!CMS all…
• CVE-2007-3784Cross-site scripting (XSS) vulnerability in the Belkin G Plu…
• CVE-2007-3785Absolute path traversal vulnerability in a certain ActiveX c…
• CVE-2007-3787The eSoft InstaGate EX2 UTM device does not require entry of…
• CVE-2007-3788The eSoft InstaGate EX2 UTM device stores the admin password…
• CVE-2007-3789SQL injection vulnerability in admin/index.php in Inmostore …
• CVE-2007-3790The com_print_typeinfo function in the bz2 extension in PHP …
• CVE-2007-3791Buffer overflow in the w_read function in sockets.c in Cami …
• CVE-2007-3792Multiple PHP remote file inclusion vulnerabilities in AzDG D…