CVE-2007-4190

CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some of these details are obtained from third party information.

• CWE-74

• http://osvdb.org/38739Broken Link
• http://secunia.com/advisories/26239Patch, Vendor Advisory
• http://www.joomla.org/content/view/3677/1/Vendor Advisory
• http://www.vupen.com/english/advisories/2007/2719Third Party Advisory
• http://osvdb.org/38739Broken Link
• http://secunia.com/advisories/26239Patch, Vendor Advisory
• http://www.joomla.org/content/view/3677/1/Vendor Advisory
• http://www.vupen.com/english/advisories/2007/2719Third Party Advisory

Published

Aug 8, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-4184SQL injection vulnerability in administrator/popups/pollwind…
• CVE-2007-4185Joomla! 1.0.12 allows remote attackers to obtain sensitive i…
• CVE-2007-4186PHP remote file inclusion vulnerability in admin.tour_toto.p…
• CVE-2007-4187Multiple eval injection vulnerabilities in the com_search co…
• CVE-2007-4188Session fixation vulnerability in Joomla! before 1.0.13 (aka…
• CVE-2007-4189Multiple cross-site scripting (XSS) vulnerabilities in Jooml…
• CVE-2007-4191Panda Antivirus 2008 stores service executables under the pr…
• CVE-2007-4192Multiple cross-site scripting (XSS) vulnerabilities in IDE G…
• CVE-2007-4193Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2007-4194Guidance Software EnCase 5.0 allows user-assisted remote att…
• CVE-2007-4195Use-after-free vulnerability in ext2fs.c in Brian Carrier Th…
• CVE-2007-4196icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 misin…