Loading story…
A cross-site scripting vulnerability, tracked as CVE-2007-3386, affects the Host Manager Servlet in Apache Tomcat versions 6.0.0 through 6.0.13 and 5.5.0 through 5.5.24. A remote attacker can submit crafted requests to inject arbitrary HTML or browser-executed script into Host Manager responses.
The flaw can be triggered through the aliases parameter used by the Host Manager html/add action. Organizations operating affected Tomcat deployments should update to a version that remediates the issue and restrict access to the Host Manager interface, particularly where it may be reachable by untrusted users.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2007-3386 was updated.
CVE-2007-3386 was published for a cross-site scripting vulnerability in Apache Tomcat's Host Manager Servlet. The flaw affects Tomcat 6.0.0 through 6.0.13 and 5.5.0 through 5.5.24, and crafted requests using the html/add action's aliases parameter can inject arbitrary HTML and script.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cross-site scripting vulnerability tracked as **CVE-2006-7195** affects Apache Tomcat's `implicit-objects.jsp` page in Tomcat versions 5.0.0–5.0.30 and 5.5.0–5.5.17. A remote attacker can supply crafted HTTP header values that are reflected into the page, enabling injection of arbitrary HTML or browser-executed script. VMware published a security announcement associated with the issue, highlighting the relevance of the vulnerable Tomcat component to VMware environments. Organizations operating affected legacy Tomcat installations or VMware products bundling those releases should apply the vendor-provided updates or otherwise remove access to the vulnerable page, and assess whether exposed management interfaces could have allowed malicious script execution in administrators' browsers.
Aug 29, 2026
Apache disclosed **CVE-2026-50229**, a basic cross-site scripting vulnerability in the Number Guess example application shipped with Apache Tomcat. The issue is classified as `CWE-80`, improper neutralization of script-related HTML tags, allowing attacker-supplied script content to be rendered in a victim’s browser when the vulnerable example is exposed. Affected supported release lines include Tomcat versions through 11.0.22, 10.1.55, 9.0.118, 8.5.100, and 7.0.109. Organizations using the example application should remove or restrict it where unnecessary and upgrade to Tomcat 11.0.23, 10.1.56, or 9.0.119; end-of-support releases may also be affected.
Aug 28, 2026
Multiple legacy Apache Tomcat releases are affected by vulnerabilities including HTTP request smuggling (`CVE-2005-2090`), insecure default SSL cipher suites (`CVE-2007-1858`), and cross-site scripting in the bundled calendar example (`CVE-2006-7196`). The request-smuggling flaw affects Tomcat 5.0.19 with Coyote/1.1 and Tomcat 4.1.24 with Coyote/1.0 when conflicting `Transfer-Encoding: chunked` and `Content-Length` headers cause request-body data to be forwarded and interpreted as a separate downstream request. Affected SSL configurations in Tomcat 4.1.28–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.17 permit anonymous and other insecure cipher suites, potentially exposing sensitive information. Separately, the `cal2.jsp` calendar example allows script injection through its `time` parameter in several Tomcat 4.x, 5.0.x, and 5.5.x releases. Organizations operating these obsolete versions should remove vulnerable example applications, disable weak SSL ciphers, and upgrade to supported Tomcat releases to mitigate cache poisoning, security-control bypass, data exposure, and XSS risks.
Aug 29, 2026