| Vulnerability Name: | CVE-2007-3484 | ||||||||
| Assigned: | 2007-06-28 | ||||||||
| Published: | 2007-06-28 | ||||||||
| Updated: | 2026-06-16 | ||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. Note: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script referenced. When a user creates a custom search engine, we provide them with a block of javascript to include on their site. Some users write additional code around this block of javascript to further customize their website. | ||||||||
| CVSS v40 Severity: | |||||||||
| CVSS v3.x Severity: | 6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
| ||||||||
| Vulnerability Type: | CWE-79 | ||||||||
| References: | Source: MITRE Type: CNA CVE-2007-3484 Source: af854a3a-2127-422b-91ae-364da2661108 Type: UNKNOWN af854a3a-2127-422b-91ae-364da2661108 Source: cve@mitre.org Type: UNKNOWN cve@mitre.org Source: af854a3a-2127-422b-91ae-364da2661108 Type: UNKNOWN af854a3a-2127-422b-91ae-364da2661108 Source: cve@mitre.org Type: UNKNOWN cve@mitre.org Source: af854a3a-2127-422b-91ae-364da2661108 Type: UNKNOWN af854a3a-2127-422b-91ae-364da2661108 Source: cve@mitre.org Type: UNKNOWN cve@mitre.org | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||