CVE Feed

    Dashboard / CVE / CVE-2007-1280

    CVE-2007-1280

    Cross-site scripting (XSS) vulnerability in Adobe RoboHelp X5, 6, and Server 6 allows remote attackers to inject arbitrary web script or HTML via a URL after a # (hash) in the URL path, as demonstrated using en/frameset-7.html, and possibly other unspecified vectors involving templates and (1) whstart.js and (2) whcsh_home.htm in WebHelp, (3) wf_startpage.js and (4) wf_startqs.htm in FlashHelp, or (5) WindowManager.dll in RoboHelp Server 6.

    Published:May 9, 2007
    Last Modified:Apr 23, 2026
    EPS:May 9, 2007
    EPSS Score:0.03931
    CVSS Score:4.3

    Affected Products

    Vendor
    Adobe
    Product
    Robohelp
    Vendor
    Adobe
    Product
    Robohelp Server
    Vendor
    Microsoft
    Product
    All Windows

    Exploits

    https://www.exploit-db.com/exploits/30016

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2022-23201 (CVSS 6.1) — Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerabi…
    CVE-2021-21070 (CVSS 6.5) — Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability…
    CVE-2017-3105 (CVSS 6.1) — Adobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and RH2017 before…
    CVE-2017-3104 (CVSS 6.1) — Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12.0.4.460 and R…
    CVE-2016-7891 (CVSS 6.1) — Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could…
    CVE-2016-1035 (CVSS 7.5) — Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive inform…
    CVE-2013-5327 (CVSS 10) — MDBMS.dll in Adobe RoboHelp 10 allows attackers to execute arbitrary code or cause a denial of service (memory…
    CVE-2012-0765 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 8 and 9 for Word allow remote attackers …
    CVE-2011-2133 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 8 and 9 before 9.0.1.262, and RoboHelp Server 8 and…
    CVE-2011-0613 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in RoboHelp 7 and 8, and RoboHelp Server 7 and 8, allow re…

    References

    http://osvdb.org/35867
    http://secunia.com/advisories/25211
    http://www.adobe.com/support/security/bulletins/apsb07-10.html
    http://www.devtarget.org/adobe-advisory-05-2007.txt
    http://www.securityfocus.com/archive/1/468360/100/0/threaded
    http://www.securityfocus.com/bid/23878
    http://www.securitytracker.com/id?1018020
    http://www.vupen.com/english/advisories/2007/1714
    https://exchange.xforce.ibmcloud.com/vulnerabilities/34181
    http://osvdb.org/35867
    http://secunia.com/advisories/25211
    http://www.adobe.com/support/security/bulletins/apsb07-10.html
    http://www.devtarget.org/adobe-advisory-05-2007.txt
    http://www.securityfocus.com/archive/1/468360/100/0/threaded
    http://www.securityfocus.com/bid/23878
    http://www.securitytracker.com/id?1018020
    http://www.vupen.com/english/advisories/2007/1714
    https://exchange.xforce.ibmcloud.com/vulnerabilities/34181

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High