CVE-2007-4633

Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to inject arbitrary web script or HTML via the lang variable to the (1) user or (2) admin logon page, aka CSCsi10728.

• CWE-79

• http://secunia.com/advisories/26641Vendor Advisory
• http://securitytracker.com/id?1018624
• http://www.cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/25480
• http://www.vupen.com/english/advisories/2007/3010
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36325
• http://secunia.com/advisories/26641Vendor Advisory
• http://securitytracker.com/id?1018624
• http://www.cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/25480
• http://www.vupen.com/english/advisories/2007/3010
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36325

Published

Aug 31, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-4627SQL injection vulnerability in index.php in ABC eStore 3.0 a…
• CVE-2007-4628SQL injection vulnerability in shownews.php in phpns 1.1 all…
• CVE-2007-4629Buffer overflow in the processLine function in maptemplate.c…
• CVE-2007-4630Cross-site scripting (XSS) vulnerability in xlaapmview.asp i…
• CVE-2007-4631The DataLoader::doStart function in dataloader.cpp in QGit 1…
• CVE-2007-4632Cisco IOS 12.2E, 12.2F, and 12.2S places a "no login" line i…
• CVE-2007-4634Multiple SQL injection vulnerabilities in Cisco CallManager …
• CVE-2007-4635Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attac…
• CVE-2007-4636Multiple PHP remote file inclusion vulnerabilities in phpBG …
• CVE-2007-4637xGB.php in xGB 2.0 does not require authentication for an ad…
• CVE-2007-4638Blizzard Entertainment StarCraft Brood War 1.15.1 and earlie…
• CVE-2007-4639EnterpriseDB Advanced Server 8.2 does not properly handle ce…