CVE-2007-5990: Cross-site scripting (XSS) vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web scri...

Security readout for executives and security teams

CVE-2007-5990 is a reported cross-site scripting issue in ExoPHPdesk user profiles. An attacker may be able to store or reflect script/HTML through profile fields, potentially affecting users who view the profile. The public bundle does not identify affected versions, CVSS score, vendor patch status, or active exploitation. Exposure is likely limited to organizations still running ExoPHPdesk, especially internet-facing helpdesk instances with public registration or editable user profiles. The provided data does not name exact versions or CPEs, so asset discovery is required before impact can be confirmed. Treat this as a legacy exposure discovery item, not an emergency based on current evidence. Prioritize if ExoPHPdesk is internet-facing, still used for customer support, or accessible by untrusted users. Unsupported software should be retired or isolated. Mitigation focus: Inventory systems for any ExoPHPdesk deployment, including archived or legacy helpdesk sites.; Check vendor or archived project guidance for patches or secure upgrade paths.; Restrict public registration or profile editing if business use does not require it..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.