Vulnerability record · CVE-2007-4512 · published 10 September 2007

CVE-2007-4512: Sophos anti-virus cross-site scripting vulnerability

Sophos · Anti Virus

Cross-site scripting (XSS) vulnerability in Sophos Anti-Virus for Windows 6.x before 6.5.8 and 7.x before 7.0.1 allows remote attackers to inject arbitrary web script or HTML via an archive with a file that matches a virus signature and has a crafted filename that is not properly handled by the print function in SavMain.exe.

4.3 CVSS 2.0 Medium EPSS 4.8% · top 8.2% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

4.8%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

16References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Anti Virus Sophos

References

Link	Tags
http://osvdb.org/37527
http://secunia.com/advisories/26714
http://securityreason.com/securityalert/3107
http://www.securityfocus.com/archive/1/478708/100/0/threaded
http://www.securityfocus.com/bid/25572	Patch
http://www.sophos.com/support/knowledgebase/article/29150.html	Patch
http://www.vupen.com/english/advisories/2007/3077
https://exchange.xforce.ibmcloud.com/vulnerabilities/36478
http://osvdb.org/37527
http://secunia.com/advisories/26714
http://securityreason.com/securityalert/3107
http://www.securityfocus.com/archive/1/478708/100/0/threaded
http://www.securityfocus.com/bid/25572	Patch
http://www.sophos.com/support/knowledgebase/article/29150.html	Patch
http://www.vupen.com/english/advisories/2007/3077
https://exchange.xforce.ibmcloud.com/vulnerabilities/36478

Track CVE-2007-4512 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-6904Sophos anti-virus vulnerabilityMultiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux, and possibly other products and versions, allow remote attackers to cause a …EPSS 11%6 Aug 2009 9.3CVE-2008-5541Sophos anti-virus improper input validation vulnerabilitySophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placin…EPSS 7.6%12 Dec 2008 7.8CVE-2007-4577Sophos anti-virus vulnerabilitySophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip file that re…EPSS 5.5%28 Aug 2007 7.2CVE-2010-2308Sophos anti-virus vulnerabilityUnspecified vulnerability in the filter driver (savonaccessfilter.sys) in Sophos Anti-Virus before 7.6.20 allows local users to gain privileges via c…EPSS 1.2%16 Jun 2010 6.9CVE-2008-1737Sophos anti-virus improper input validation vulnerabilitySophos Anti-Virus 7.0.5, and other 7.x versions, when Runtime Behavioural Analysis is enabled, allows local users to cause a denial of service (reboo…EPSS 0.62%30 Apr 2008 6.8CVE-2007-4578Sophos anti-virus vulnerabilitySophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbi…EPSS 7.3%28 Aug 2007 6.4CVE-2006-5647Sophos anti-virus memory buffer overflow vulnerabilitySophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to …EPSS 21%1 Nov 2006 5.0CVE-2006-5645Sophos anti-virus vulnerabilitySophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when "Enabled scanning of …EPSS 18%1 Nov 2006

Source: NIST National Vulnerability Database (record CVE-2007-4512), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.