CVE-2006-7195: Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and...

Security readout for executives and security teams

This is an old cross-site scripting flaw in Apache Tomcat 5 example code. If a vulnerable implicit-objects.jsp page is reachable, crafted HTTP header values could be reflected as script or HTML in a user’s browser. Business risk depends on whether legacy Tomcat 5 or bundled Tomcat components are still exposed. Exposure is most likely in legacy Tomcat 5 deployments or third-party products that bundled vulnerable Tomcat versions, including vendor contexts referenced by VMware, Red Hat, Avaya, and CA advisories. Modern supported Tomcat installations are not identified as affected in the provided sources. Handle as a legacy exposure cleanup issue. It is not supported by the bundle as actively exploited, but any internet-facing Tomcat 5 or bundled product exposure should be remediated promptly because the affected software is very old. Mitigation focus: Identify Tomcat 5.0.x and 5.5.x instances and bundled Tomcat components.; Upgrade or apply vendor-supported fixes according to Apache and product vendor guidance.; Remove or restrict access to example JSP pages, including implicit-objects.jsp..

Prepared

Jun 29, 2026, 05:42 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.