← Vulnerability feed

Vulnerability record · CVE-2007-1499 · published 17 March 2007

CVE-2007-1499: Microsoft ie cross-site scripting vulnerability

Microsoft · Ie

Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."

4.3 CVSS 2.0 Medium EPSS 30% · top 1.9% CWE-79 · Cross-site scripting
4.3CVSS 2.0 base score
30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
36References
16 Jun 2026Last modified by NVD

Description

Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx Vendor Advisory
http://news.com.com/2100-1002_3-6167410.html
http://osvdb.org/35352
http://secunia.com/advisories/24535 Vendor Advisory
http://secunia.com/advisories/25627 Vendor Advisory
http://securityreason.com/securityalert/2448
http://securitytracker.com/id?1018235
http://www.securityfocus.com/archive/1/462833/100/0/threaded
http://www.securityfocus.com/archive/1/462939/100/0/threaded
http://www.securityfocus.com/archive/1/462945/100/0/threaded
http://www.securityfocus.com/archive/1/471947/100/0/threaded
http://www.securityfocus.com/bid/22966
http://www.us-cert.gov/cas/techalerts/TA07-163A.html US Government Resource
http://www.vupen.com/english/advisories/2007/0946
http://www.vupen.com/english/advisories/2007/2153
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033
https://exchange.xforce.ibmcloud.com/vulnerabilities/33026
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1715
http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx Vendor Advisory
http://news.com.com/2100-1002_3-6167410.html
http://osvdb.org/35352
http://secunia.com/advisories/24535 Vendor Advisory
http://secunia.com/advisories/25627 Vendor Advisory
http://securityreason.com/securityalert/2448
http://securitytracker.com/id?1018235
http://www.securityfocus.com/archive/1/462833/100/0/threaded
http://www.securityfocus.com/archive/1/462939/100/0/threaded
http://www.securityfocus.com/archive/1/462945/100/0/threaded
http://www.securityfocus.com/archive/1/471947/100/0/threaded
http://www.securityfocus.com/bid/22966
http://www.us-cert.gov/cas/techalerts/TA07-163A.html US Government Resource
http://www.vupen.com/english/advisories/2007/0946
http://www.vupen.com/english/advisories/2007/2153
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033
https://exchange.xforce.ibmcloud.com/vulnerabilities/33026
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1715

Track CVE-2007-1499 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2007-0219Microsoft internet explorer vulnerabilityMicrosoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, …EPSS 39%10.0CVE-2007-0217Internet Explorer wininet.dll FTP client heap corruptionThe FTP client code in wininet.dll, used by Microsoft Internet Explorer 5.01 and 6, mishandles an FTP server response of a specific length, writing a…EPSS 58%analysed10.0CVE-2006-1186Internet Explorer ActiveX COM object instantiation memory corruptionInternet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code by instantiating the Mdt2gddr.dll, Mdt2dd.dll, and Mdt2gddo.dll CO…EPSS 58%analysed10.0CVE-2004-0985Microsoft ie vulnerabilityInternet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file typ…EPSS 20%10.0CVE-2004-1050Internet Explorer 6 heap overflow via IFRAME, FRAME and EMBED attributesInternet Explorer 6 contains a heap-based buffer overflow triggered by long SRC or NAME attributes in IFRAME, FRAME and EMBED elements. A remote atta…EPSS 67%analysed10.0CVE-2004-0216Internet Explorer Install Engine integer overflow enables remote code executionThe Install Engine (inseng.dll) in Internet Explorer 5.01, 5.5, and 6 contains an integer overflow when calculating a buffer length for a long .CAB f…EPSS 49%analysed10.0CVE-2004-0212Windows Task Scheduler .job file stack buffer overflowThe Windows Task Scheduler in Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, contains a stack-based buffer overflow triggered by a .…EPSS 64%analysed10.0CVE-2004-0420Windows Shell CLSID filename spoofing allows remote code executionThe Windows Shell trusts a CLSID specifier embedded in a filename, letting a remote attacker spoof the file type and cause arbitrary code execution. …EPSS 46%analysed

Source: NIST National Vulnerability Database (record CVE-2007-1499), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.