CVE-2004-2509 Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via...
MediumCVSS 4.3
EPSS 2.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubbcentral ubb.threads | = 6.2.3 | No fix listed |
| ubbcentral ubb.threads | = 6.5 | No fix listed |
References
- 20041213 Multiple XSS Vulnerabilities in several UBB.Thread Versions exploit mailing-list
- 13452 third-party-advisory vendor-advisory
- 1012503 exploit vdb-entry
- 12365 patch vdb-entry
- 12366 patch vdb-entry
- 12367 patch vdb-entry
- 11900 exploit vdb-entry
- ubbthreads-multiple-scripts-xss(18432) vdb-entry