CVE-2007-2892: Cross-site scripting (XSS) vulnerability in news.asp in ASP-Nuke 2.0.7 allows remote attackers to inject ar...

Security readout for executives and security teams

This is a reported cross-site scripting issue in ASP-Nuke 2.0.7. A remote attacker may be able to make the news.asp page return attacker-controlled script or HTML through the id parameter. Business impact depends on whether this old application is still exposed and whether users trust or authenticate to it. Exposure is likely limited to organizations still running ASP-Nuke 2.0.7, especially internet-facing news.asp endpoints. The bundle does not identify broader affected versions, package names, CPEs, or maintained vendor channels. Prioritize asset discovery first. Treat this as urgent only if ASP-Nuke 2.0.7 is still reachable, especially on public sites or authenticated portals. Otherwise, track it as legacy technical debt with incomplete evidence and no confirmed active exploitation in the provided sources. Mitigation focus: Inventory public and internal ASP-Nuke 2.0.7 deployments.; Check vendor or maintainer guidance for any official fix.; Retire or replace unsupported ASP-Nuke instances where feasible..

Prepared

Jun 29, 2026, 05:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.