CVE-2007-3420: Web-App.org Webapp

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the (1) username, (2) password, (3) usertheme, and (4) userlang cookies for unauthorized users, which has unknown impact and remote attack vectors.

Affected products

• Web-App.org Webapp: up to and including 0.9.9.6

Published 2007-06-26. Last modified 2026-06-16.