CVE-2007-1355

CVE-2007-1355 describes multiple cross-site scripting (XSS) vulnerabilities found in the appdev/sample/web/hello.jsp example application across various versions of Apache Tomcat (4.0.0-4.0.6, 4.1.0-4.1.36, 5.0.0-5.0.30, 5.5.0-5.5.23, and 6.0.0-6.0.10). An attacker could inject arbitrary web script or HTML via the 'test' parameter and other unspecified vectors. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and potential for partial integrity impact, but no confidentiality or availability impact. Its EPSS score of 0.833 suggests a high likelihood of exploitation. While not listed on the CISA KEV catalog or currently active on the Hot List, exploit code for this vulnerability is publicly available via ExploitDB. There is no evidence of active exploitation in the wild, and it has received minimal community discussion or media coverage.