CVE-2007-2847: Multiple cross-site scripting (XSS) vulnerabilities in hlstats.php in HLstats 1.35, and possibly earlier, a...

Security readout for executives and security teams

CVE-2007-2847 is an old cross-site scripting issue in HLstats 1.35, possibly earlier. An attacker could inject script or HTML through login-related parameters in hlstats.php. Business risk depends on whether HLstats is still exposed and who uses it. The source bundle does not provide a CVSS score or confirmed active exploitation. Exposure is most likely where legacy HLstats web interfaces remain reachable, especially public hlstats.php pages. The bundle lists no normalized affected product data, so asset confirmation requires local inventory rather than relying on CPE matching. Handle as a legacy exposure cleanup item unless HLstats is publicly accessible or used by privileged staff. Public exposure raises urgency because XSS can affect trusted users of the web interface. Mitigation focus: Inventory internet-facing and internal HLstats deployments.; Check project or vendor guidance for fixed versions or official workarounds.; Remove or retire unused HLstats installations..

Prepared

Jun 29, 2026, 05:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.