$ cve CVE-2003-1347 JSON

CVE-2003-1347 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 2% (pctl 80)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Geeklog 1.3.7 allow remote attackers to inject arbitrary web script or HTML via the (1) cid parameter to comment.php, (2) uid parameter to profiles.php, (3) uid to users.php, and (4) homepage field.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	2.01% — more likely to be exploited than 80% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2003-12-31
Last modified	2026-06-16

Affected (1)

Vendor	Product
geeklog	geeklog

Public exploits

Source	Title	Date
exploit-db	Geeklog 1.3.7 - 'profiles.php' Multiple Cross-Site Scripting Vulnerabilities	2003-01-14
exploit-db	Geeklog 1.3.7 - 'users.php?uid' Cross-Site Scripting	2003-01-14
exploit-db	Geeklog 1.3.7 - 'comment.php?cid' Cross-Site Scripting	2003-01-14
exploit-db	Geeklog 1.3.7 - 'Homepage User' HTML Injection	2003-01-14

References

→ the Explorer · watch your stack · NVD