Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web scrip…

Published 19 y ago 2007-06-28 · modified 4 mo ago 2026-06-16 · JSON

CVSS

6.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 38%

Public exploits

none known

Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script referenced. When a user creates a custom search engine, we provide them with a block of javascript to include on their site. Some users write additional code around this block of javascript to further customize their website.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago 2024-05-24

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
CNA	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

osvdb.org /38038 · vdb-entry, x_refsource_OSVDB, x_transferred
attrition.org /pipermail/vim/2007-July/001706.html · mailing-list, x_refsource_VIM, x_transferred
websecurity.com.ua /1050/ · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2007-3484
NVD: CVE-2007-3484

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.